CVE-2022-29221 PHP Code Injection by malicious block or filename in Smarty

2022-05-2400:00:00

CWE-94

GitHub_M

www.cve.org

cve-2022-29221

php

code injection

smarty

template engine

security patch

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.8

Confidence

High

EPSS

0.003

Percentile

69.6%

JSON

Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to versions 3.1.45 and 4.1.1, template authors could inject php code by choosing a malicious {block} name or {include} file name. Sites that cannot fully trust template authors should upgrade to versions 3.1.45 or 4.1.1 to receive a patch for this issue. There are currently no known workarounds.

CNA Affected

[
  {
    "vendor": "smarty-php",
    "product": "smarty",
    "versions": [
      {
        "version": "< 3.1.45",
        "status": "affected"
      },
      {
        "version": ">= 4.0.0, < 4.1.1",
        "status": "affected"
      }
    ]
  }
]