Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
osvGoogleOSV:GHSA-7J98-H7FP-4VWJ
HistoryMar 29, 2023 - 6:31 p.m.

smarty Cross-site Scripting vulnerability in Javascript escaping

2023-03-2918:31:35
Google
osv.dev
19
cross-site scripting
arbitrary javascript code
user browser session
sensitive user data
web application manipulation
unauthorized actions
smarty v3
smarty v4
github repo

CVSS3

7.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

EPSS

0.002

Percentile

52.7%

JSON

Impact

An attacker could exploit this vulnerability to execute arbitrary JavaScript code in the context of the user’s browser session. This may lead to unauthorized access to sensitive user data, manipulation of the web application’s behavior, or unauthorized actions performed on behalf of the user.

Patches

Please upgrade to the most recent version of Smarty v3 or v4.

For more information

If you have any questions or comments about this advisory please open an issue in the Smarty repo

Related

githubexploit 1
fedora 3
openvas 5
nessus 4
prion 1
ubuntucve 1
debiancve 1
nvd 1
osv 2
mageia 1
friendsofphp 1
cvelist 1
github 1
veracode 1
cve 1
ubuntu 1
githubexploit
githubexploit
Exploit for Cross-site Scripting in Smarty
2023-03-30 10:28:20
fedora
fedora
[SECURITY] Fedora 36 Update: php-Smarty-3.1.48-1.fc36
2023-04-12 01:39:15
[SECURITY] Fedora 37 Update: php-Smarty-3.1.48-1.fc37
2023-04-12 01:34:31
[SECURITY] Fedora 38 Update: php-Smarty-3.1.48-1.fc38
2023-04-15 02:15:24
openvas
openvas
Fedora: Security Advisory for php-Smarty (FEDORA-2023-4b03f6cd8a)
2023-04-13 00:00:00
Mageia: Security Advisory (MGASA-2023-0155)
2023-04-24 00:00:00
Fedora: Security Advisory for php-Smarty (FEDORA-2023-7490239652)
2023-04-13 00:00:00
nessus
nessus
Fedora 38 : php-Smarty (2023-199edf23f0)
2023-04-15 00:00:00
Fedora 36 : php-Smarty (2023-7490239652)
2023-04-12 00:00:00
Fedora 37 : php-Smarty (2023-4b03f6cd8a)
2023-04-12 00:00:00
prion
prion
Design/Logic Flaw
2023-03-28 21:15:00
ubuntucve
ubuntucve
CVE-2023-28447
2023-03-28 00:00:00
debiancve
debiancve
CVE-2023-28447
2023-03-28 21:15:11
nvd
nvd
CVE-2023-28447
2023-03-28 21:15:11
osv
osv
CVE-2023-28447
2023-03-28 21:15:11
postfixadmin vulnerabilities
2023-12-12 12:15:17
mageia
mageia
Updated php-smarty packages fix security vulnerability
2023-04-24 03:20:26
friendsofphp
friendsofphp
Cross site scripting vulnerability in Javascript escaping
2023-03-28 19:41:00
cvelist
cvelist
CVE-2023-28447 Cross site scripting vulnerability in Javascript escaping in smarty/smarty
2023-03-28 20:07:39
github
github
smarty Cross-site Scripting vulnerability in Javascript escaping
2023-03-29 18:31:35
veracode
veracode
Cross-Site Scripting (XSS)
2023-04-04 11:26:16
cve
cve
CVE-2023-28447
2023-03-28 21:15:11
ubuntu
ubuntu
PostfixAdmin vulnerabilities
2023-12-12 00:00:00

CVSS3

7.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

EPSS

0.002

Percentile

52.7%

JSON
Related for OSV:GHSA-7J98-H7FP-4VWJ
githubexploit1fedora3openvas5nessus4prion1ubuntucve1debiancve1nvd1osv2mageia1friendsofphp1cvelist1github1veracode1cve1ubuntu1