CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
EPSS
Percentile
54.2%
In Smarty before 3.1.47 and 4.x before 4.2.1, libs/plugins/function.mailto.php allows XSS. A web page that uses smarty_function_mailto, and that could be parameterized using GET or POST input parameters, could allow injection of JavaScript code by a user.
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
Debian | 12 | all | smarty3 | < 3.1.47-1 | smarty3_3.1.47-1_all.deb |
Debian | 11 | all | smarty3 | <= 3.1.39-2+deb11u1 | smarty3_3.1.39-2+deb11u1_all.deb |
Debian | 999 | all | smarty3 | < 3.1.47-1 | smarty3_3.1.47-1_all.deb |
Debian | 12 | all | smarty4 | < 4.2.1-1 | smarty4_4.2.1-1_all.deb |
Debian | 999 | all | smarty4 | < 4.2.1-1 | smarty4_4.2.1-1_all.deb |