CVE-2014-8350

Publicada em 03 nov 2014 · Atualizada em 06 ago 2024

Seguir esta CVE + Monitorar smarty3 + Monitorar smarty/smarty

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

3Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackepss 3.1%

Smarty before 3.1.21 allows remote attackers to bypass the secure mode restrictions and execute arbitrary PHP code as demonstrated by "{literal}<{/literal}script language=php>" in a template.

Produtos afetados

n/a · n/a

Referências

http://advisories.mageia.org/MGASA-2014-0468.html https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=765920 https://code.google.com/p/smarty-php/source/browse/trunk/distribution/change_log.txt?r=4902 http://seclists.org/oss-sec/2014/q4/420 http://seclists.org/oss-sec/2014/q4/421 https://exchange.xforce.ibmcloud.com/vulnerabilities/97725 http://www.mandriva.com/security/advisories?name=MDVSA-2014:221 http://www.securityfocus.com/bid/70708