Ubuntu.comUB:CVE-2018-25047CVE-2018-25047
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
EPSS
Percentile
54.2%
In Smarty before 3.1.47 and 4.x before 4.2.1,
libs/plugins/function.mailto.php allows XSS. A web page that uses
smarty_function_mailto, and that could be parameterized using GET or POST
input parameters, could allow injection of JavaScript code by a user.
Bugs
References
bugs.gentoo.org/870100
github.com/smarty-php/smarty/commit/55ea25d1f50f0406fb1ccedd212c527977793fc9 (v4.2.1)
github.com/smarty-php/smarty/commit/f1f7ee6e34c14a8a9dfa5c6ef894d39277a93938 (v3.1.47)
github.com/smarty-php/smarty/issues/454
github.com/smarty-php/smarty/releases/tag/v3.1.47
github.com/smarty-php/smarty/releases/tag/v4.2.1
launchpad.net/bugs/cve/CVE-2018-25047
nvd.nist.gov/vuln/detail/CVE-2018-25047
security-tracker.debian.org/tracker/CVE-2018-25047
www.cve.org/CVERecord?id=CVE-2018-25047
Related
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
EPSS
Percentile
54.2%