Log in Start free

Vulnerability · Published Mar 28, 2023 · Assigned by GitHub_M

CVE-2023-28447Cross site scripting vulnerability in Javascript escaping in smarty/smarty

High 7.1

In plain English

A high-severity cross-site scripting in smarty from smarty-php. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 63% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.1High
Exploit odds (30 days)1.0%top 36.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Public PoC

Official description

Smarty is a template engine for PHP. In affected versions smarty did not properly escape javascript code. An attacker could exploit this vulnerability to execute arbitrary JavaScript code in the context of the user's browser session. This may lead to unauthorized access to sensitive user data, manipulation of the web application's behavior, or unauthorized actions performed on behalf of the user. Users are advised to upgrade to either version 3.1.48 or to 4.3.1 to resolve this issue. There are no known workarounds for this vulnerability.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12smarty33.1.47-2+deb12u1DSA-5826-1
Debian:12smarty33.1.47-2+deb12u1DEBIAN-CVE-2023-28447
Debian:13smarty33.1.48-1DEBIAN-CVE-2023-28447
Debian:14smarty33.1.48-1DEBIAN-CVE-2023-28447
Debian:12smarty44.3.0-1+deb12u1DEBIAN-CVE-2023-28447
Debian:13smarty44.3.1-1DEBIAN-CVE-2023-28447
Debian:14smarty44.3.1-1DEBIAN-CVE-2023-28447
Packagistsmarty/smarty3.1.48GHSA-7j98-h7fp-4vwj
Packagistsmarty/smarty4.3.1GHSA-7j98-h7fp-4vwj
Ubuntu:22.04:LTSsmarty33.1.39-2ubuntu1.22.04.2USN-7158-1
Ubuntu:22.04:LTSsmarty33.1.39-2ubuntu1.22.04.2UBUNTU-CVE-2023-28447
Ubuntu:24.04:LTSsmarty33.1.48-1ubuntu0.24.04.1UBUNTU-CVE-2023-28447
Ubuntu:24.04:LTSsmarty33.1.48-1ubuntu0.24.04.1USN-7158-1

Affected products (as reported)

VendorProductVersions
smarty-php smarty >= 4.0.0, < 4.3.1< 3.1.48

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

References