The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-52154efd61 advisory.

  - Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from     application logic. Prior to versions 3.1.43 and 4.0.3, template authors could run restricted static php     methods. Users should upgrade to version 3.1.43 or 4.0.3 to receive a patch. (CVE-2021-21408)

  - Smarty before 3.1.39 allows a Sandbox Escape because $smarty.template_object can be accessed in sandbox     mode. (CVE-2021-26119)

  - Smarty before 3.1.39 allows code injection via an unexpected function name after a {function name=     substring. (CVE-2021-26120)

  - Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from     application logic. Prior to versions 3.1.42 and 4.0.2, template authors could run arbitrary PHP code by     crafting a malicious math string. If a math string was passed through as user provided data to the math     function, external users could run arbitrary PHP code by crafting a malicious math string. Users should     upgrade to version 3.1.42 or 4.0.2 to receive a patch. (CVE-2021-29454)

  - Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from     application logic. Prior to versions 3.1.45 and 4.1.1, template authors could inject php code by choosing     a malicious {block} name or {include} file name. Sites that cannot fully trust template authors should     upgrade to versions 3.1.45 or 4.1.1 to receive a patch for this issue. There are currently no known     workarounds. (CVE-2022-29221)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202209-09 (Smarty: Multiple vulnerabilities)

  - In Smarty before 3.1.47 and 4.x before 4.2.1, libs/plugins/function.mailto.php allows XSS. A web page that     uses smarty_function_mailto, and that could be parameterized using GET or POST input parameters, could     allow injection of JavaScript code by a user. (CVE-2018-25047)

  - Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from     application logic. Prior to versions 3.1.43 and 4.0.3, template authors could run restricted static php     methods. Users should upgrade to version 3.1.43 or 4.0.3 to receive a patch. (CVE-2021-21408)

  - Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from     application logic. Prior to versions 3.1.42 and 4.0.2, template authors could run arbitrary PHP code by     crafting a malicious math string. If a math string was passed through as user provided data to the math     function, external users could run arbitrary PHP code by crafting a malicious math string. Users should     upgrade to version 3.1.42 or 4.0.2 to receive a patch. (CVE-2021-29454)

  - Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from     application logic. Prior to versions 3.1.45 and 4.1.1, template authors could inject php code by choosing     a malicious {block} name or {include} file name. Sites that cannot fully trust template authors should     upgrade to versions 3.1.45 or 4.1.1 to receive a patch for this issue. There are currently no known     workarounds. (CVE-2022-29221)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 ESM host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5348-3 advisory.

  - Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from     application logic. Prior to versions 3.1.43 and 4.0.3, template authors could run restricted static php     methods. Users should upgrade to version 3.1.43 or 4.0.3 to receive a patch. (CVE-2021-21408)

  - Smarty before 3.1.39 allows a Sandbox Escape because $smarty.template_object can be accessed in sandbox     mode. (CVE-2021-26119)

  - Smarty before 3.1.39 allows code injection via an unexpected function name after a {function name=     substring. (CVE-2021-26120)

  - Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from     application logic. Prior to versions 3.1.42 and 4.0.2, template authors could run arbitrary PHP code by     crafting a malicious math string. If a math string was passed through as user provided data to the math     function, external users could run arbitrary PHP code by crafting a malicious math string. Users should     upgrade to version 3.1.42 or 4.0.2 to receive a patch. (CVE-2021-29454)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 / 11 host has a package installed that is affected by multiple vulnerabilities as referenced in the dsa-5151 advisory.

  - Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from     application logic. Prior to versions 3.1.43 and 4.0.3, template authors could run restricted static php     methods. Users should upgrade to version 3.1.43 or 4.0.3 to receive a patch. (CVE-2021-21408)

  - Smarty before 3.1.39 allows a Sandbox Escape because $smarty.template_object can be accessed in sandbox     mode. (CVE-2021-26119)

  - Smarty before 3.1.39 allows code injection via an unexpected function name after a {function name=     substring. (CVE-2021-26120)

  - Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from     application logic. Prior to versions 3.1.42 and 4.0.2, template authors could run arbitrary PHP code by     crafting a malicious math string. If a math string was passed through as user provided data to the math     function, external users could run arbitrary PHP code by crafting a malicious math string. Users should     upgrade to version 3.1.42 or 4.0.2 to receive a patch. (CVE-2021-29454)

  - Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from     application logic. Prior to versions 3.1.45 and 4.1.1, template authors could inject php code by choosing     a malicious {block} name or {include} file name. Sites that cannot fully trust template authors should     upgrade to versions 3.1.45 or 4.1.1 to receive a patch for this issue. There are currently no known     workarounds. (CVE-2022-29221)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5348-2 advisory.

  - Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from     application logic. Prior to versions 3.1.43 and 4.0.3, template authors could run restricted static php     methods. Users should upgrade to version 3.1.43 or 4.0.3 to receive a patch. (CVE-2021-21408)

  - Smarty before 3.1.39 allows a Sandbox Escape because $smarty.template_object can be accessed in sandbox     mode. (CVE-2021-26119)

  - Smarty before 3.1.39 allows code injection via an unexpected function name after a {function name=     substring. (CVE-2021-26120)

  - Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from     application logic. Prior to versions 3.1.42 and 4.0.2, template authors could run arbitrary PHP code by     crafting a malicious math string. If a math string was passed through as user provided data to the math     function, external users could run arbitrary PHP code by crafting a malicious math string. Users should     upgrade to version 3.1.42 or 4.0.2 to receive a patch. (CVE-2021-29454)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-2995 advisory.

  - Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from     application logic. Prior to versions 3.1.43 and 4.0.3, template authors could run restricted static php     methods. Users should upgrade to version 3.1.43 or 4.0.3 to receive a patch. (CVE-2021-21408)

  - Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from     application logic. Prior to versions 3.1.42 and 4.0.2, template authors could run arbitrary PHP code by     crafting a malicious math string. If a math string was passed through as user provided data to the math     function, external users could run arbitrary PHP code by crafting a malicious math string. Users should     upgrade to version 3.1.42 or 4.0.2 to receive a patch. (CVE-2021-29454)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 21.10 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5348-1 advisory.

  - Smarty_Security::isTrustedResourceDir() in Smarty before 3.1.33 is prone to a path traversal vulnerability     due to insufficient template code sanitization. This allows attackers controlling the executed template     code to bypass the trusted directory security restriction and read arbitrary files. (CVE-2018-13982)

  - Smarty before 3.1.33-dev-4 allows attackers to bypass the trusted_dir protection mechanism via a     file:./../ substring in an include statement. (CVE-2018-16831)

  - Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from     application logic. Prior to versions 3.1.43 and 4.0.3, template authors could run restricted static php     methods. Users should upgrade to version 3.1.43 or 4.0.3 to receive a patch. (CVE-2021-21408)

  - Smarty before 3.1.39 allows a Sandbox Escape because $smarty.template_object can be accessed in sandbox     mode. (CVE-2021-26119)

  - Smarty before 3.1.39 allows code injection via an unexpected function name after a {function name=     substring. (CVE-2021-26120)

  - Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from     application logic. Prior to versions 3.1.42 and 4.0.2, template authors could run arbitrary PHP code by     crafting a malicious math string. If a math string was passed through as user provided data to the math     function, external users could run arbitrary PHP code by crafting a malicious math string. Users should     upgrade to version 3.1.42 or 4.0.2 to receive a patch. (CVE-2021-29454)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
169147	Fedora 36 : php-Smarty (2022-52154efd61)	Nessus	Fedora Local Security Checks	12/22/2022	9/12/2023	critical
165442	GLSA-202209-09 : Smarty: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	9/25/2022	10/10/2023	high
183593	Ubuntu 20.04 ESM : Smarty vulnerabilities (USN-5348-3)	Nessus	Ubuntu Local Security Checks	10/20/2023	10/20/2023	critical
161686	Debian DSA-5151-1 : smarty3 - security update	Nessus	Debian Local Security Checks	5/31/2022	10/26/2023	critical
183613	Ubuntu 16.04 ESM : Smarty vulnerabilities (USN-5348-2)	Nessus	Ubuntu Local Security Checks	10/20/2023	10/20/2023	critical
160680	Debian DLA-2995-1 : smarty3 - LTS security update	Nessus	Debian Local Security Checks	5/6/2022	5/6/2022	high
159268	Ubuntu 18.04 LTS : Smarty vulnerabilities (USN-5348-1)	Nessus	Ubuntu Local Security Checks	3/28/2022	10/16/2023	critical

Detections

Analytics

Plugins Search

critical

high

critical

critical

critical

high

critical