GHSA-9gqj-ppv2-f2hqmedium
Cross-site Scripting in SmartyException
Impact
Cross-site scripting (XSS) vulnerability in the SmartyException class in Smarty (aka smarty-php) before 3.1.12 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors that trigger a Smarty exception.
Source excerpt · OSVAffected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
smarty/smarty Packagist
| Affected range | Recorded fix |
|---|---|
| Earlier releases before 3.1.12Ecosystem versions | 3.1.12 |
Version evidence: OSV · GHSA-9gqj-ppv2-f2hq
View original version evidence (10 explicit versions)
Original source description
Cross-site scripting (XSS) vulnerability in the SmartyException class in Smarty (aka smarty-php) before 3.1.12 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors that trigger a Smarty exception.
References
- Security advisory nvd.nist.gov/vuln/detail/CVE-2012-4437
- Source reference code.google.com/p/smarty-php/source/browse/trunk/distribution/change_log.txt
- Source reference code.google.com/p/smarty-php/source/detail
- Source reference github.com/smarty-php/smarty
- Source reference lists.fedoraproject.org/pipermail/package-announce/2012-September/088138.html
- Security advisory web.archive.org/web/20140201075419/http://www.securityfocus.com/bid/55506
- Security advisory www.openwall.com/lists/oss-security/2012/09/19/1
- Security advisory www.openwall.com/lists/oss-security/2012/09/20/3