CVE-2017-1000480: Smarty PHP code injection
Smarty 3 before 3.1.32 is vulnerable to a PHP code injection when calling fetch() or display() functions on custom resources that does not sanitize template name.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/smarty3to a version that resolves this vulnerability.Fixed in 3.1.33+20180830.1.3a78a21f+selfpack1-1+deb10u1Fixed in 3.1.33+20180830.1.3a78a21f+selfpack1-1+deb10u2Fixed in 3.1.39-2+deb11u1Fixed in 3.1.47-2Fixed in 3.1.48-1 - Upgrade
Upgrade
composer/smarty/smartyto a version that resolves this vulnerability.Fixed in 3.1.32
Event History
Frequently Asked Questions
What is the severity of CVE-2017-1000480?
CVE-2017-1000480 is classified as a critical vulnerability due to the potential for PHP code injection.
How does CVE-2017-1000480 affect Smarty 3 users?
Users of Smarty 3 prior to version 3.1.32 are at risk of unauthorized PHP code execution when using fetch() or display() functions.
How do I fix CVE-2017-1000480?
To mitigate CVE-2017-1000480, upgrade Smarty to versions 3.1.33 or later.
What versions are vulnerable to CVE-2017-1000480?
Smarty versions before 3.1.32 are vulnerable to CVE-2017-1000480.
Is there a workaround for CVE-2017-1000480 if I cannot upgrade?
It is recommended to sanitize template names when calling fetch() or display() functions to help mitigate the risk if an upgrade is not possible.