smarty/smarty-v4.3.0: 1 vulnerabilities (highest severity is: 6.1)

[mend-bolt-for-github]

Vulnerable Library - smarty/smarty-v4.3.0

Smarty - the compiling PHP template engine

Library home page: https://api.github.com/repos/smarty-php/smarty/zipball/c02e9e135ea719b91f457a0072748ded0e852e7d

Found in HEAD commit: ad06856b39153f425da332dea44087d7b4bf93ce

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (smarty/smarty-v4.3.0 version)	Remediation Possible**
CVE-2023-28447	Medium	6.1	smarty/smarty-v4.3.0	Direct	v3.1.48,v4.3.1	❌

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2023-28447

Vulnerable Library - smarty/smarty-v4.3.0

Smarty - the compiling PHP template engine

Library home page: https://api.github.com/repos/smarty-php/smarty/zipball/c02e9e135ea719b91f457a0072748ded0e852e7d

Dependency Hierarchy:

• ❌ smarty/smarty-v4.3.0 (Vulnerable Library)

Found in HEAD commit: ad06856b39153f425da332dea44087d7b4bf93ce

Found in base branch: raconteur

Vulnerability Details

Smarty is a template engine for PHP. In affected versions smarty did not properly escape javascript code. An attacker could exploit this vulnerability to execute arbitrary JavaScript code in the context of the user's browser session. This may lead to unauthorized access to sensitive user data, manipulation of the web application's behavior, or unauthorized actions performed on behalf of the user. Users are advised to upgrade to either version 3.1.48 or to 4.3.1 to resolve this issue. There are no known workarounds for this vulnerability.

Publish Date: 2023-03-28

URL: CVE-2023-28447

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-7j98-h7fp-4vwj

Release Date: 2023-03-28

Fix Resolution: v3.1.48,v4.3.1

Step up your Open Source Security Game with Mend here