GHSA-7j98-h7fp-4vwj
smarty Cross-site Scripting vulnerability in Javascript escaping
At a glance
- Published
- Updated
- CVE
- CVE-2023-28447
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Description
### Impact An attacker could exploit this vulnerability to execute arbitrary JavaScript code in the context of the user's browser session. This may lead to unauthorized access to sensitive user data, manipulation of the web application's behavior, or unauthorized actions performed on behalf of the user. ### Patches Please upgrade to the most recent version of Smarty v3 or v4. ### For more information If you have any questions or comments about this advisory please open an issue in [the Smarty repo](https://github.com/smarty-php/smarty)
Affected packages
| Package | Versions |
|---|---|
| Packagist · smarty/smarty | introduced 4.0.0, fixed 4.3.1 |
| Packagist · smarty/smarty | introduced 0, fixed 3.1.48 |
References
- https://github.com/smarty-php/smarty/security/advisories/GHSA-7j98-h7fp-4vwj WEB
- https://nvd.nist.gov/vuln/detail/CVE-2023-28447 ADVISORY
- https://github.com/smarty-php/smarty/commit/685662466f653597428966d75a661073104d713d WEB
- https://github.com/FriendsOfPHP/security-advisories/blob/master/smarty/smarty/CVE-2023-28447.yaml WEB
- https://github.com/smarty-php/smarty PACKAGE
- https://lists.debian.org/debian-lts-announce/2024/11/msg00013.html WEB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HSAUM3YHWHO4UCJXRGRLQGPJAO3MFOZZ WEB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JBB35GLYTL6JL6EOM6BOZNYP47JKNNHT WEB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P7O7SKTATM6GAP45S64QFXNLWIY5I7HP WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |