CVE-2021-21408
published 2022-01-10CVE-2021-21408: Access to restricted PHP code by dynamic static class access in smarty Smarty is a template engine for PHP, facilitating the separation of presentation…
high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
2.22%
80.5th percentile
Access to restricted PHP code by dynamic static class access in smarty
Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to versions 3.1.43 and 4.0.3, template authors could run restricted static php methods. Users should upgrade to version 3.1.43 or 4.0.3 to receive a patch.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| smarty-php | smarty | < 3.1.43 | 3.1.43 |
| smarty-php | smarty | — | — |
| smarty | smarty | >= 0 < 3.1.43 | 3.1.43 |
| smarty | smarty | >= 4.0.0 < 4.0.3 | 4.0.3 |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
cvelistv58.8HIGH
osv7.5HIGH
vendor_ubuntu7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Smarty vulnerabilities
vendor_ubuntu·2022-06-21·CVSS 7.5
CVE-2021-26120 [HIGH] Smarty vulnerabilities
Title: Smarty vulnerabilities
Summary: Several security issues were fixed in Smarty.
USN-5348-1 fixed several vulnerabilities in Smarty. This update provides
the fixes for CVE-2021-21408, CVE-2021-26119, CVE-2021-26120 and
CVE-2021-29454 for Ubuntu 20.04 ESM.
Original advisory details:
David Gnedt and Thomas Konrad discovered that Smarty was incorrectly
sanitizing the paths present in the templates. An attacker could possibly
use this use to read arbitrary files when controlling the executed
template. (CVE-2018-13982)
It was discovered that Smarty was incorrectly sanitizing the paths
present in the templates. An attacker could possibly use this use to read
arbitrary files when controlling the executed template. (CVE-2018-16831)
It was discovered that Smarty was incorrectly validating
Ubuntu
Smarty vulnerabilities
vendor_ubuntu·2022-03-28·CVSS 7.5
CVE-2021-21408 [HIGH] Smarty vulnerabilities
Title: Smarty vulnerabilities
Summary: Several security issues were fixed in Smarty.
David Gnedt and Thomas Konrad discovered that Smarty was incorrectly
sanitizing the paths present in the templates. An attacker could possibly
use this use to read arbitrary files when controlling the executed
template. (CVE-2018-13982)
It was discovered that Smarty was incorrectly sanitizing the paths
present in the templates. An attacker could possibly use this use to read
arbitrary files when controlling the executed template. (CVE-2018-16831)
It was discovered that Smarty was incorrectly validating security policy
data, allowing the execution of static classes even when not permitted by
the security settings. An attacker could possibly use this issue to
execute arbitrary code. (CVE-2021-21408)
It
Ubuntu
Smarty vulnerabilities
vendor_ubuntu·2022-03-28·CVSS 7.5
CVE-2021-26120 [HIGH] Smarty vulnerabilities
Title: Smarty vulnerabilities
Summary: Several security issues were fixed in Smarty.
USN-5348-1 fixed several vulnerabilities in Smarty. This update provides
the fixes for CVE-2021-21408, CVE-2021-26119, CVE-2021-26120 and
CVE-2021-29454 for Ubuntu 16.04 ESM.
Original advisory details:
David Gnedt and Thomas Konrad discovered that Smarty was incorrectly
sanitizing the paths present in the templates. An attacker could possibly
use this use to read arbitrary files when controlling the executed
template. (CVE-2018-13982)
It was discovered that Smarty was incorrectly sanitizing the paths
present in the templates. An attacker could possibly use this use to read
arbitrary files when controlling the executed template. (CVE-2018-16831)
It was discovered that Smarty was incorrectly validating
OSV
smarty3 vulnerabilities
osv·2022-06-21·CVSS 7.5
CVE-2021-21408 [HIGH] smarty3 vulnerabilities
smarty3 vulnerabilities
USN-5348-1 fixed several vulnerabilities in Smarty. This update provides
the fixes for CVE-2021-21408, CVE-2021-26119, CVE-2021-26120 and
CVE-2021-29454 for Ubuntu 20.04 ESM.
Original advisory details:
David Gnedt and Thomas Konrad discovered that Smarty was incorrectly
sanitizing the paths present in the templates. An attacker could possibly
use this use to read arbitrary files when controlling the executed
template. (CVE-2018-13982)
It was discovered that Smarty was incorrectly sanitizing the paths
present in the templates. An attacker could possibly use this use to read
arbitrary files when controlling the executed template. (CVE-2018-16831)
It was discovered that Smarty was incorrectly validating security policy
data, allowing the execution of static classe
OSV
smarty3 vulnerabilities
osv·2022-03-28·CVSS 7.5
CVE-2018-13982 [HIGH] smarty3 vulnerabilities
smarty3 vulnerabilities
David Gnedt and Thomas Konrad discovered that Smarty was incorrectly
sanitizing the paths present in the templates. An attacker could possibly
use this use to read arbitrary files when controlling the executed
template. (CVE-2018-13982)
It was discovered that Smarty was incorrectly sanitizing the paths
present in the templates. An attacker could possibly use this use to read
arbitrary files when controlling the executed template. (CVE-2018-16831)
It was discovered that Smarty was incorrectly validating security policy
data, allowing the execution of static classes even when not permitted by
the security settings. An attacker could possibly use this issue to
execute arbitrary code. (CVE-2021-21408)
It was discovered that Smarty was incorrectly managing access con
OSV
smarty3 vulnerabilities
osv·2022-03-28·CVSS 7.5
CVE-2021-21408 [HIGH] smarty3 vulnerabilities
smarty3 vulnerabilities
USN-5348-1 fixed several vulnerabilities in Smarty. This update provides
the fixes for CVE-2021-21408, CVE-2021-26119, CVE-2021-26120 and
CVE-2021-29454 for Ubuntu 16.04 ESM.
Original advisory details:
David Gnedt and Thomas Konrad discovered that Smarty was incorrectly
sanitizing the paths present in the templates. An attacker could possibly
use this use to read arbitrary files when controlling the executed
template. (CVE-2018-13982)
It was discovered that Smarty was incorrectly sanitizing the paths
present in the templates. An attacker could possibly use this use to read
arbitrary files when controlling the executed template. (CVE-2018-16831)
It was discovered that Smarty was incorrectly validating security policy
data, allowing the execution of static classe
OSV
Access to restricted PHP code by dynamic static class access in smarty
osv·2022-01-12
CVE-2021-21408 [HIGH] Access to restricted PHP code by dynamic static class access in smarty
Access to restricted PHP code by dynamic static class access in smarty
### Impact
Template authors could run restricted static php methods.
### Patches
Please upgrade to 3.1.40 or higher.
### References
See the [documentation on Smarty security features](https://www.smarty.net/docs/en/advanced.features.tpl#advanced.features.security) on the static_classes access filter.
### For more information
If you have any questions or comments about this advisory please open an issue in [the Smarty repo](https://github.com/smarty-php/smarty)
GHSA
Access to restricted PHP code by dynamic static class access in smarty
ghsa·2022-01-12
CVE-2021-21408 [HIGH] CWE-20 Access to restricted PHP code by dynamic static class access in smarty
Access to restricted PHP code by dynamic static class access in smarty
### Impact
Template authors could run restricted static php methods.
### Patches
Please upgrade to 3.1.40 or higher.
### References
See the [documentation on Smarty security features](https://www.smarty.net/docs/en/advanced.features.tpl#advanced.features.security) on the static_classes access filter.
### For more information
If you have any questions or comments about this advisory please open an issue in [the Smarty repo](https://github.com/smarty-php/smarty)
CVEList
Access to restricted PHP code by dynamic static class access in smarty
cvelistv5·2022-01-10·CVSS 8.8
CVE-2021-21408 [HIGH] CWE-20 Access to restricted PHP code by dynamic static class access in smarty
Access to restricted PHP code by dynamic static class access in smarty
Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to versions 3.1.43 and 4.0.3, template authors could run restricted static php methods. Users should upgrade to version 3.1.43 or 4.0.3 to receive a patch.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2022-01-10
Published