CVE-2018-13982

Description

Smarty_Security::isTrustedResourceDir() in Smarty before 3.1.33 is prone to a path traversal vulnerability due to insufficient template code sanitization. This allows attackers controlling the executed template code to bypass the trusted directory security restriction and read arbitrary files.

Risk Information

Base Score

7.5

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS Score

Exploitation Probability

2.453

Associated Vulnerability

Vulnerability	OS Platform
The compiling PHP template engine (USN-5348-1) smarty3_3.1.39-2ubuntu0.21.10.1_all.deb	Linux
The compiling PHP template engine (USN-5348-1) smarty3_3.1.31+20161214.1.c7d42e4+selfpack1-3ubuntu0.1_all.deb	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234