CVE-2021-29454

Description

Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to versions 3.1.42 and 4.0.2, template authors could run arbitrary PHP code by crafting a malicious math string. If a math string was passed through as user provided data to the math function, external users could run arbitrary PHP code by crafting a malicious math string. Users should upgrade to version 3.1.42 or 4.0.2 to receive a patch.

Weakness classification

• security-advisories@github.com: CWE-74
• nvd@nist.gov: CWE-74

Primary references

• security-advisories@github.com — Patch, Third Party Advisory
• security-advisories@github.com — Release Notes, Third Party Advisory
• security-advisories@github.com — Release Notes, Third Party Advisory
• security-advisories@github.com — Third Party Advisory
• security-advisories@github.com — Mailing List, Third Party Advisory
• security-advisories@github.com
• security-advisories@github.com
• security-advisories@github.com — Product, Third Party Advisory
• security-advisories@github.com — Third Party Advisory
• security-advisories@github.com — Third Party Advisory
• security-advisories@github.com — Vendor Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Patch, Third Party Advisory