p PatchFirst

CVE-2023-28447

CVE-2023-28447 · Cross site scripting vulnerability in Javascript escaping in smarty/smarty

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Smarty is a template engine for PHP. In affected versions smarty did not properly escape javascript code. An attacker could exploit this vulnerability to execute arbitrary JavaScript code in the context of the user's browser session. This may lead to unauthorized access to sensitive user data, manipulation of the web application's behavior, or unauthorized actions performed on behalf of the user. Users are advised to upgrade to either version 3.1.48 or to 4.3.1 to resolve this issue. There are no known workarounds for this vulnerability.

CVSS 7.1 · High · EPSS 1.0% · Fix available

Published
Updated

Stack: system · php

Affected products and versions

  • smarty

    Versions
    • >= 4.0.0, < 4.3.1: Affected
    • < 3.1.48: Affected

    No fix published

  • smarty3 Debian:12

    Versions
    • 3.1.47-2
    Affected ranges
    • ECOSYSTEM: < 3.1.47-2+deb12u1

    Update to 3.1.47-2+deb12u1

  • smarty3 Debian:13

    Affected ranges
    • ECOSYSTEM: < 3.1.48-1

    Update to 3.1.48-1

  • smarty3 Debian:14

    Affected ranges
    • ECOSYSTEM: < 3.1.48-1

    Update to 3.1.48-1

  • smarty4 Debian:12

    Versions
    • 4.3.0-1
    Affected ranges
    • ECOSYSTEM: < 4.3.0-1+deb12u1

    Update to 4.3.0-1+deb12u1

  • smarty4 Debian:13

    Affected ranges
    • ECOSYSTEM: < 4.3.1-1

    Update to 4.3.1-1

  • smarty4 Debian:14

    Affected ranges
    • ECOSYSTEM: < 4.3.1-1

    Update to 4.3.1-1

  • smarty/smarty Packagist

    Versions
    • v4.0.0
    • v4.0.1
    • v4.0.2
    • v4.0.3
    • v4.0.4
    • v4.1.0
    • v4.1.1
    • v4.2.0
    • v4.2.1
    • v4.3.0
    Affected ranges
    • ECOSYSTEM: ≥ 4.0.0, < 4.3.1

    Update to 4.3.1

  • smarty/smarty Packagist

    Versions
    • v2.6.24
    • v2.6.25
    • v2.6.26
    • v2.6.27
    • v2.6.28
    • v2.6.29
    • v2.6.30
    • v2.6.31
    • v2.6.33
    • v3.1.11
    • v3.1.12
    • v3.1.13
    • v3.1.14
    • v3.1.15
    • v3.1.16
    • v3.1.17
    • v3.1.18
    • v3.1.19
    • v3.1.20
    • v3.1.21
    • v3.1.23
    • v3.1.24
    • v3.1.25
    • v3.1.26
    • v3.1.27
    • v3.1.28
    • v3.1.29
    • v3.1.30
    • v3.1.31
    • v3.1.32
    • v3.1.33
    • v3.1.34
    • v3.1.35
    • v3.1.36
    • v3.1.37
    • v3.1.37.1
    • v3.1.38
    • v3.1.39
    • v3.1.40
    • v3.1.41
    • v3.1.42
    • v3.1.43
    • v3.1.44
    • v3.1.45
    • v3.1.46
    • v3.1.47
    Affected ranges
    • ECOSYSTEM: < 3.1.48

    Update to 3.1.48

  • civicrm Ubuntu:Pro:16.04:LTS

    Versions
    • 4.7.1+dfsg-1
    • 4.7.1+dfsg-2
    • 4.7.1+dfsg-2ubuntu1
    Affected ranges
    • ECOSYSTEM: < 4.7.1+dfsg-2ubuntu1+esm1

    Update to 4.7.1+dfsg-2ubuntu1+esm1

  • smarty3 Ubuntu:Pro:16.04:LTS

    Versions
    • 3.1.21-1
    • 3.1.21-1ubuntu1
    • 3.1.21-1ubuntu1+esm1
    Affected ranges
    • ECOSYSTEM: < 3.1.21-1ubuntu1+esm2

    Update to 3.1.21-1ubuntu1+esm2

  • civicrm Ubuntu:Pro:18.04:LTS

    Versions
    • 4.7.23+dfsg-1ubuntu1
    • 4.7.24+dfsg-1ubuntu1
    • 4.7.30+dfsg-1ubuntu1
    Affected ranges
    • ECOSYSTEM: < 4.7.30+dfsg-1ubuntu1+esm1

    Update to 4.7.30+dfsg-1ubuntu1+esm1

  • postfixadmin Ubuntu:Pro:18.04:LTS

    Versions
    • 3.0.2-2
    Affected ranges
    • ECOSYSTEM: < 3.0.2-2ubuntu0.1~esm1

    Update to 3.0.2-2ubuntu0.1~esm1

  • smarty3 Ubuntu:Pro:18.04:LTS

    Versions
    • 3.1.31+20161214.1.c7d42e4+selfpack1-2
    • 3.1.31+20161214.1.c7d42e4+selfpack1-3
    • 3.1.31+20161214.1.c7d42e4+selfpack1-3ubuntu0.1
    Affected ranges
    • ECOSYSTEM: < 3.1.31+20161214.1.c7d42e4+selfpack1-3ubuntu0.1+esm1

    Update to 3.1.31+20161214.1.c7d42e4+selfpack1-3ubuntu0.1+esm1

  • smarty3 Ubuntu:20.04:LTS

    Versions
    • 3.1.33+20180830.1.3a78a21f+selfpack1-1
    • 3.1.34+20190228.1.c9f0de05+selfpack1-1
    Affected ranges
    • ECOSYSTEM: < 3.1.34+20190228.1.c9f0de05+selfpack1-1ubuntu0.1

    Update to 3.1.34+20190228.1.c9f0de05+selfpack1-1ubuntu0.1

  • civicrm Ubuntu:Pro:20.04:LTS

    Versions
    • 5.11.0+dfsg-1
    • 5.18.1+dfsg-1
    • 5.20.3+dfsg-1
    • 5.21.0+dfsg-1
    • 5.21.1+dfsg-1
    • 5.21.2+dfsg-1
    Affected ranges
    • ECOSYSTEM: < 5.21.2+dfsg-1ubuntu0.1~esm1

    Update to 5.21.2+dfsg-1ubuntu0.1~esm1

  • postfixadmin Ubuntu:Pro:20.04:LTS

    Versions
    • 3.2.1-2
    • 3.2.1-3
    Affected ranges
    • ECOSYSTEM: < 3.2.1-3ubuntu0.1~esm1

    Update to 3.2.1-3ubuntu0.1~esm1

  • smarty3 Ubuntu:22.04:LTS

    Versions
    • 3.1.39-2
    • 3.1.39-2ubuntu1
    • 3.1.39-2ubuntu1.22.04.1
    Affected ranges
    • ECOSYSTEM: < 3.1.39-2ubuntu1.22.04.2

    Update to 3.1.39-2ubuntu1.22.04.2

  • civicrm Ubuntu:Pro:22.04:LTS

    Versions
    • 5.33.2+dfsg1-1
    • 5.33.2+dfsg1-1build1
    • 5.33.2+dfsg1-1ubuntu1
    Affected ranges
    • ECOSYSTEM: < 5.33.2+dfsg1-1ubuntu1+esm1

    Update to 5.33.2+dfsg1-1ubuntu1+esm1

  • postfixadmin Ubuntu:Pro:22.04:LTS

    Versions
    • 3.3.7-1
    • 3.3.10-2
    Affected ranges
    • ECOSYSTEM: < 3.3.10-2ubuntu0.1~esm1

    Update to 3.3.10-2ubuntu0.1~esm1

  • smarty3 Ubuntu:24.04:LTS

    Versions
    • 3.1.48-1
    Affected ranges
    • ECOSYSTEM: < 3.1.48-1ubuntu0.24.04.1

    Update to 3.1.48-1ubuntu0.24.04.1

  • postfixadmin Ubuntu:Pro:24.04:LTS

    Versions
    • 3.3.13-1
    Affected ranges
    • ECOSYSTEM: < 3.3.13-1ubuntu0.1~esm1

    Update to 3.3.13-1ubuntu0.1~esm1

Original sources

Check your server →