Logo
›
›vulnerability›CVE-2018-25047
Name
CVE-2018-25047
Source
NVD ( link)Debian ( link)
Description
In Smarty before 3.1.47 and 4.x before 4.2.1, libs/plugins/function.mailto.php allows XSS. A web page that uses smarty_function_mailto, and that could be parameterized using GET or POST input parameters, could allow injection of JavaScript code by a user.
CWEs
CWE-79
Published Date
Updated Date
Workaround
-
Advisories
https://bugs.gentoo.org/870100Issue Tracking
https://github.com/smarty-php/smarty/issues/454Exploit
https://github.com/smarty-php/smarty/releases/tag/v3.1.47Release Notes
https://github.com/smarty-php/smarty/releases/tag/v4.2.1Release Notes
https://lists.debian.org/debian-lts-announce/2023/01/msg00002.htmlMailing List
https://security.gentoo.org/glsa/202209-09Third Party Advisory
https://bugs.gentoo.org/870100Issue Tracking
https://github.com/smarty-php/smarty/issues/454Exploit
https://github.com/smarty-php/smarty/releases/tag/v3.1.47Release Notes
https://github.com/smarty-php/smarty/releases/tag/v4.2.1Release Notes
https://lists.debian.org/debian-lts-announce/2023/01/msg00002.htmlMailing List
https://security.gentoo.org/glsa/202209-09Third Party Advisory

Analysis#

Affected Component
Analysis
smarty
Patched

Vulnerability Rating#

5.4
CVSSv31

Others affected components#

Name
Project
Project Version
Version
Status
smarty
yocto
master
5.8.0
Not Affected
smarty
yocto
scarthgap
4.4.1
Not Affected

Resolved with patches#

smarty (yocto:kirkstone)

#
Title
Author
Resolve
1
Applied appropriate javascript and html escaping in mailto
Simon Wisselink <s.wisselink@iwink.nl>
CVE-2018-25047