CVE-2009-5054: Smarty Does Not Consider Umask Values When Setting Permissions
Smarty before 3.0.0 beta 4 does not consider the umask value when setting the permissions of files, which might allow attackers to bypass intended access restrictions via standard filesystem operations.
Other sources
Smarty Does Not Consider Umask Values When Setting Permissions
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/smarty/smartyto a version that resolves this vulnerability.Fixed in 3.0.0-beta4 - Upgrade
Upgrade
Smartyto a version that resolves this vulnerability.Fixed in 3.0.0 beta 4
Event History
Frequently Asked Questions
What is the severity of CVE-2009-5054?
CVE-2009-5054 has a moderate severity rating due to the potential for unauthorized file access.
How do I fix CVE-2009-5054?
To fix CVE-2009-5054, upgrade Smarty to version 3.0.0-beta4 or later.
Which versions of Smarty are affected by CVE-2009-5054?
CVE-2009-5054 affects Smarty versions prior to 3.0.0 beta 4.
What type of vulnerability is CVE-2009-5054?
CVE-2009-5054 is a file permission vulnerability that can lead to unintended access restrictions being bypassed.
Can I mitigate CVE-2009-5054 without upgrading?
Mitigating CVE-2009-5054 without upgrading is challenging; it's recommended to apply the upgrade for complete resolution.