CVE-2009-5054
published 2011-02-03CVE-2009-5054: Smarty before 3.0.0 beta 4 does not consider the umask value when setting the permissions of files, which might allow attackers to bypass intended access…
PriorityP434high7.5CVSS 2.0
AVNACLAuNCPIPAP
EPSS
1.59%
72.6th percentile
Smarty before 3.0.0 beta 4 does not consider the umask value when setting the permissions of files, which might allow attackers to bypass intended access restrictions via standard filesystem operations.
Affected
56 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | smarty3 | < smarty3 3.0~rc1-1 (bookworm) | smarty3 3.0~rc1-1 (bookworm) |
| smarty | smarty | <= 2.6.26 | — |
| smarty | smarty | — | — |
| smarty | smarty | — | — |
| smarty | smarty | — | — |
| smarty | smarty | — | — |
| smarty | smarty | — | — |
| smarty | smarty | — | — |
| smarty | smarty | — | — |
| smarty | smarty | — | — |
| smarty | smarty | — | — |
| smarty | smarty | — | — |
| smarty | smarty | — | — |
| smarty | smarty | — | — |
| smarty | smarty | — | — |
| smarty | smarty | — | — |
| smarty | smarty | — | — |
| smarty | smarty | — | — |
| smarty | smarty | — | — |
| smarty | smarty | — | — |
| smarty | smarty | — | — |
| smarty | smarty | — | — |
| smarty | smarty | — | — |
| smarty | smarty | — | — |
| smarty | smarty | — | — |
CVSS provenance
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv7.5HIGH
vendor_debian7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Smarty Does Not Consider Umask Values When Setting Permissions
osv·2022-05-02
CVE-2009-5054 [MEDIUM] Smarty Does Not Consider Umask Values When Setting Permissions
Smarty Does Not Consider Umask Values When Setting Permissions
Smarty before 3.0.0 beta 4 does not consider the umask value when setting the permissions of files, which might allow attackers to bypass intended access restrictions via standard filesystem operations.
GHSA
Smarty Does Not Consider Umask Values When Setting Permissions
ghsa·2022-05-02
CVE-2009-5054 [MEDIUM] CWE-281 Smarty Does Not Consider Umask Values When Setting Permissions
Smarty Does Not Consider Umask Values When Setting Permissions
Smarty before 3.0.0 beta 4 does not consider the umask value when setting the permissions of files, which might allow attackers to bypass intended access restrictions via standard filesystem operations.
OSV
CVE-2009-5054: Smarty before 3
osv·2011-02-03·CVSS 7.5
CVE-2009-5054 [HIGH] CVE-2009-5054: Smarty before 3
Smarty before 3.0.0 beta 4 does not consider the umask value when setting the permissions of files, which might allow attackers to bypass intended access restrictions via standard filesystem operations.
Debian
CVE-2009-5054: smarty3 - Smarty before 3.0.0 beta 4 does not consider the umask value when setting the pe...
vendor_debian·2009·CVSS 7.5
CVE-2009-5054 [HIGH] CVE-2009-5054: smarty3 - Smarty before 3.0.0 beta 4 does not consider the umask value when setting the pe...
Smarty before 3.0.0 beta 4 does not consider the umask value when setting the permissions of files, which might allow attackers to bypass intended access restrictions via standard filesystem operations.
Scope: local
bookworm: resolved (fixed in 3.0~rc1-1)
bullseye: resolved (fixed in 3.0~rc1-1)
forky: resolved (fixed in 3.0~rc1-1)
sid: resolved (fixed in 3.0~rc1-1)
trixie: resolved (fixed in 3.0~rc1-1)
No detection rules found.
No public exploits indexed.
2011-02-03
Published