Vulnerabilities > CVE-2022-29221

CVSS 8.8 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

LOW

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

network

low complexity

smarty

debian

fedoraproject

NVD

Published: 2022-05-24

Updated: 2024-11-21

Summary

Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to versions 3.1.45 and 4.1.1, template authors could inject php code by choosing a malicious {block} name or {include} file name. Sites that cannot fully trust template authors should upgrade to versions 3.1.45 or 4.1.1 to receive a patch for this issue. There are currently no known workarounds.

Vulnerable Configurations

Part	Description	Count
Application	Smarty Smarty Smarty 4.0.0 Smarty Smarty 4.0.1 Smarty Smarty 4.0.2 Smarty Smarty 4.0.3 Smarty Smarty 4.0.4 Smarty Smarty 4.1.0 Smarty Smarty 1.0 Smarty Smarty 1.0A Smarty Smarty 1.0B Smarty Smarty 1.1.0 Smarty Smarty 1.2.0 Smarty Smarty 1.2.1 Smarty Smarty 1.2.2 Smarty Smarty 1.3.0 Smarty Smarty 1.3.1 Smarty Smarty 1.3.2 Smarty Smarty 1.4.0 Smarty Smarty 1.4.1 Smarty Smarty 1.4.2 Smarty Smarty 1.4.3 Smarty Smarty 1.4.4 Smarty Smarty 1.4.5 Smarty Smarty 1.4.6 Smarty Smarty 1.5.0 Smarty Smarty 1.5.1 Smarty Smarty 1.5.2 Smarty Smarty 2.0.0 Smarty Smarty 2.0.1 Smarty Smarty 2.1.0 Smarty Smarty 2.1.1 Smarty Smarty 2.2.0 Smarty Smarty 2.3.0 Smarty Smarty 2.3.1 Smarty Smarty 2.4.0 Smarty Smarty 2.4.1 Smarty Smarty 2.4.2 Smarty Smarty 2.5.0 Smarty Smarty 2.6.0 Smarty Smarty 2.6.1 Smarty Smarty 2.6.2 Smarty Smarty 2.6.3 Smarty Smarty 2.6.4 Smarty Smarty 2.6.5 Smarty Smarty 2.6.6 Smarty Smarty 2.6.7 Smarty Smarty 2.6.9 Smarty Smarty 2.6.10 Smarty Smarty 2.6.11 Smarty Smarty 2.6.12 Smarty Smarty 2.6.13 Smarty Smarty 2.6.14 Smarty Smarty 2.6.15 Smarty Smarty 2.6.16 Smarty Smarty 2.6.17 Smarty Smarty 2.6.18 Smarty Smarty 2.6.20 Smarty Smarty 2.6.22 Smarty Smarty 2.6.24 Smarty Smarty 2.6.25 Smarty Smarty 2.6.26 Smarty Smarty 2.6.27 Smarty Smarty 2.6.28 Smarty Smarty 2.6.29 Smarty Smarty 2.6.30 Smarty Smarty 2.6.31 Smarty Smarty 3.0.0 Smarty Smarty 3.0.1 Smarty Smarty 3.0.2 Smarty Smarty 3.0.3 Smarty Smarty 3.0.4 Smarty Smarty 3.0.5 Smarty Smarty 3.0.6 Smarty Smarty 3.0.7 Smarty Smarty 3.1 Smarty Smarty 3.1.0 Smarty Smarty 3.1.1 Smarty Smarty 3.1.2 Smarty Smarty 3.1.3 Smarty Smarty 3.1.4 Smarty Smarty 3.1.5 Smarty Smarty 3.1.6 Smarty Smarty 3.1.7 Smarty Smarty 3.1.8 Smarty Smarty 3.1.9 Smarty Smarty 3.1.10 Smarty Smarty 3.1.11 Smarty Smarty 3.1.12 Smarty Smarty 3.1.13 Smarty Smarty 3.1.14 Smarty Smarty 3.1.15 Smarty Smarty 3.1.16 Smarty Smarty 3.1.17 Smarty Smarty 3.1.18 Smarty Smarty 3.1.19 Smarty Smarty 3.1.20 Smarty Smarty 3.1.21 Smarty Smarty 3.1.23 Smarty Smarty 3.1.24 Smarty Smarty 3.1.25 Smarty Smarty 3.1.26 Smarty Smarty 3.1.27 Smarty Smarty 3.1.28 Smarty Smarty 3.1.29 Smarty Smarty 3.1.30 Smarty Smarty 3.1.31 Smarty Smarty 3.1.32 Smarty Smarty 3.1.33 Smarty Smarty 3.1.34 Smarty Smarty 3.1.35 Smarty Smarty 3.1.36 Smarty Smarty 3.1.37 Smarty Smarty 3.1.37.1 Smarty Smarty 3.1.38 Smarty Smarty 3.1.39 Smarty Smarty 3.1.40 Smarty Smarty 3.1.41 Smarty Smarty 3.1.42 Smarty Smarty 3.1.43 Smarty Smarty 3.1.44	136
OS	Debian Debian Debian Linux 9.0 Debian Debian Linux 10.0 Debian Debian Linux 11.0	3
OS	Fedoraproject Fedoraproject Fedora 36 Fedoraproject Fedora 37	2

Vulnerabilities > CVE-2022-29221 {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Vulnerabilities","item":"https://cyber.vumetric.com/vulns/"},{"@type":"ListItem","position":2,"name":"CVE-2022-29221"}]}

Summary

Vulnerable Configurations

References

Vulnerabilities > CVE-2022-29221