| Vulnerability Name: | CVE-2008-1066 (CCN-41002) | ||||||||||||||||||||
| Assigned: | 2008-02-11 | ||||||||||||||||||||
| Published: | 2008-02-11 | ||||||||||||||||||||
| Updated: | 2017-08-08 | ||||||||||||||||||||
| Summary: | The modifier.regex_replace.php plugin in Smarty before 2.6.19, as used by Serendipity (S9Y) and other products, allows attackers to call arbitrary PHP functions via templates, related to a '\0' character in a search string. | ||||||||||||||||||||
| CVSS v3 Severity: | 7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
| ||||||||||||||||||||
| CVSS v2 Severity: | 7.5 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P) 5.5 Medium (Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)
5.5 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)
| ||||||||||||||||||||
| Vulnerability Type: | CWE-20 | ||||||||||||||||||||
| Vulnerability Consequences: | Bypass Security | ||||||||||||||||||||
| References: | Source: CONFIRM Type: UNKNOWN http://blog.s9y.org/archives/191-Serendipity-1.3-beta1-released.html Source: CCN Type: Serendipity Web site Serendipity 1.3 released (addresses security) Source: MITRE Type: CNA CVE-2008-1066 Source: SUSE Type: UNKNOWN SUSE-SR:2008:007 Source: CCN Type: SA29241 Smarty "regex_replace" Modifier Template Security Bypass Source: SECUNIA Type: Vendor Advisory 29241 Source: SECUNIA Type: Vendor Advisory 29392 Source: CCN Type: SA29398 Serendipity Security Bypass and Script Insertion Vulnerabilities Source: SECUNIA Type: Vendor Advisory 29398 Source: SECUNIA Type: Vendor Advisory 29405 Source: SECUNIA Type: Vendor Advisory 29562 Source: SECUNIA Type: Vendor Advisory 29839 Source: GENTOO Type: UNKNOWN GLSA-201111-04 Source: CCN Type: Smarty Download Web page Download Source: DEBIAN Type: UNKNOWN DSA-1520 Source: DEBIAN Type: DSA-1520 smarty -- insufficient input sanitising Source: CCN Type: GLSA-201006-13 Smarty: Multiple vulnerabilities Source: CCN Type: OSVDB ID: 43064 Smarty modifier.regex_replace.php Plugin Search String Arbitrary PHP Code Execution Source: CONFIRM Type: UNKNOWN http://www.phpinsider.com/smarty-forum/viewtopic.php?p=47652 Source: BID Type: UNKNOWN 28105 Source: CCN Type: BID-28105 Smarty Template Engine 'regex_replace' Template Security Bypass Vulnerability Source: CCN Type: Smarty Changelog, Feb 11th, 2008 Version 2.6.19 Source: CONFIRM Type: UNKNOWN http://www.smarty.net/misc/NEWS Source: XF Type: UNKNOWN smarty-modifierregexreplace-security-bypass(41002) Source: XF Type: UNKNOWN smarty-modifierregexreplace-security-bypass(41002) Source: FEDORA Type: UNKNOWN FEDORA-2008-2650 Source: FEDORA Type: UNKNOWN FEDORA-2008-2587 Source: FEDORA Type: UNKNOWN FEDORA-2008-2656 Source: SUSE Type: SUSE-SR:2008:007 SUSE Security Summary Report | ||||||||||||||||||||
| Vulnerable Configuration: | Configuration 1: Denotes that component is vulnerable | ||||||||||||||||||||
| Oval Definitions | |||||||||||||||||||||
| |||||||||||||||||||||
| BACK | |||||||||||||||||||||