Smarty_Security::isTrustedResourceDir() in Smarty before 3.1.33 is prone to a path traversal vulnerability due to insufficient template code sanitization. This allows attackers controlling the executed template code to bypass the trusted directory security restriction and read arbitrary files.
References
Link | Resource |
---|---|
https://github.com/sbaresearch/advisories/tree/public/2018/SBA-ADV-20180420-01_Smarty_Path_Traversal | Exploit Patch Third Party Advisory |
https://github.com/smarty-php/smarty/commit/2e081a51b1effddb23f87952959139ac62654d50 | Patch Vendor Advisory |
https://github.com/smarty-php/smarty/commit/8d21f38dc35c4cd6b31c2f23fc9b8e5adbc56dfe | Patch Vendor Advisory |
https://github.com/smarty-php/smarty/commit/bcedfd6b58bed4a7366336979ebaa5a240581531 | Patch Vendor Advisory |
https://github.com/smarty-php/smarty/commit/c9dbe1d08c081912d02bd851d1d1b6388f6133d1 | Patch Vendor Advisory |
https://github.com/smarty-php/smarty/commit/f9ca3c63d1250bb56b2bda609dcc9dd81f0065f8 | Patch Vendor Advisory |
https://lists.debian.org/debian-lts-announce/2021/04/msg00004.html | Mailing List Third Party Advisory |
https://lists.debian.org/debian-lts-announce/2021/04/msg00014.html | Mailing List Third Party Advisory |
https://lists.debian.org/debian-lts-announce/2021/10/msg00015.html | Mailing List Third Party Advisory |
Configurations
History
02 Nov 2021, 14:01
Type | Values Removed | Values Added |
---|---|---|
References | (MLIST) https://lists.debian.org/debian-lts-announce/2021/10/msg00015.html - Mailing List, Third Party Advisory | |
References | (MLIST) https://lists.debian.org/debian-lts-announce/2021/04/msg00004.html - Mailing List, Third Party Advisory | |
References | (MLIST) https://lists.debian.org/debian-lts-announce/2021/04/msg00014.html - Mailing List, Third Party Advisory | |
CPE | cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* |
20 Oct 2021, 14:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
Information
Published : 2018-09-18 21:29
Updated : 2024-02-04 20:03
NVD link : CVE-2018-13982
Mitre link : CVE-2018-13982
CVE.ORG link : CVE-2018-13982
JSON object : View
Products Affected
debian
- debian_linux
smarty
- smarty
CWE
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')