CVE-2022-29221

描述

Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to versions 3.1.45 and 4.1.1, template authors could inject php code by choosing a malicious {block} name or {include} file name. Sites that cannot fully trust template authors should upgrade to versions 3.1.45 or 4.1.1 to receive a patch for this issue. There are currently no known workarounds.

如何修補 CVE-2022-29221

要修補 CVE-2022-29221,請將受影響套件升級到下列已修補版本。

• —升級至 3.1.39-2+deb11u1 或更新版本
• —升級至 3.1.31+20161214.1.c7d42e4+selfpack1-2+deb9u6 或更新版本
• —升級至 4.1.1-1 或更新版本
• —升級至 3.1.45 或更新版本

CVE-2022-29221 正在被利用嗎?

低 — EPSS 為 4.5%,目前沒有觀察到大規模利用活動。

受影響套件(4)

• from 0, < 3.1.39-2+deb11u1
• from 0, < 3.1.31+20161214.1.c7d42e4+selfpack1-2+deb9u6
• from 0, < 4.1.1-1
• from 0, < 3.1.45

CVSS 分數

參考連結(13)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2022-29221
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2022-29221
• PATCHgithub.com/smarty-php/smarty
• WEBgithub.com/FriendsOfPHP/security-advisories/blob/master/smarty/smarty/CVE-2022-29221.yaml