CVE-2014-8350 Smarty arbitrary PHP code execution
Remote attackers can bypass secure mode restrictions in the Smarty PHP template engine to execute arbitrary PHP code.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2014-8350?
CVE-2014-8350 is a high-severity code injection vulnerability in n/a, published on 3 Nov 2014. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Smarty before 3.1.21 allows remote attackers to bypass the secure mode restrictions and execute arbitrary PHP code as demonstrated by "{literal}<{/literal}script language=php>" in a template.
Weakness: CWE-94
Which versions are affected by CVE-2014-8350?
2 open source packages ship an affected version, including smarty/smarty. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
smarty/smarty Packagist | All versions | 3.1.21 |
smarty/smarty Packagist | All versions | 3.1.21 |
Products include Smarty Smarty.
How do I fix CVE-2014-8350?
Upgrade smarty/smarty to 3.1.21 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2014-8350 being exploited?
There is no known exploitation of CVE-2014-8350 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as DEBIAN-CVE-2014-8350, DLA-452-1, GHSA-2pmx-6mm6-6v72, MGASA-2014-0469.