CVE-2014-8350: Smarty arbitrary PHP code execution
Smarty arbitrary PHP code execution
Other sources
Smarty before 3.1.21 allows remote attackers to bypass the secure mode restrictions and execute arbitrary PHP code as demonstrated by "{literal}<{/literal}script language=php>" in a template.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/smarty/smartyto a version that resolves this vulnerability.Fixed in 3.1.21 - Upgrade
Upgrade
Smartyto a version that resolves this vulnerability.Fixed in 3.1.21
Event History
Frequently Asked Questions
What is the severity of CVE-2014-8350?
CVE-2014-8350 has a medium severity rating as it allows remote code execution due to a vulnerability in Smarty before version 3.1.21.
How do I fix CVE-2014-8350?
To fix CVE-2014-8350, upgrade Smarty to version 3.1.21 or later.
Which versions are affected by CVE-2014-8350?
CVE-2014-8350 affects all Smarty versions before 3.1.21, including several earlier versions like 1.x and 2.x.
Can CVE-2014-8350 be exploited remotely?
Yes, CVE-2014-8350 can be exploited remotely by attackers to execute arbitrary PHP code via crafted templates.
Is there a patch for CVE-2014-8350?
There is no separate patch for CVE-2014-8350; the only solution is to upgrade to the fixed version 3.1.21.