GHSA-7j98-h7fp-4vwj

smarty Cross-site Scripting vulnerability in Javascript escaping

Source: GitHub Advisory Database (reviewed) High CVE-2023-28447

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	smarty/smarty	>= 4.0.0, < 4.3.1	4.3.1
Packagist	smarty/smarty	< 3.1.48	3.1.48

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact An attacker could exploit this vulnerability to execute arbitrary JavaScript code in the context of the user's browser session. This may lead to unauthorized access to sensitive user data, manipulation of the web application's behavior, or unauthorized actions performed on behalf of the user. ### Patches Please upgrade to the most recent version of Smarty v3 or v4. ### For more information If you have any questions or comments about this advisory please open an issue in [the Smarty repo](https://github.com/smarty-php/smarty)

References

External links from the advisory. They lead to third-party sites.

https://github.com/smarty-php/smarty/security/advisories/GHSA-7j98-h7fp-4vwj web
https://nvd.nist.gov/vuln/detail/CVE-2023-28447 advisory
https://github.com/smarty-php/smarty/commit/685662466f653597428966d75a661073104d713d web
https://github.com/FriendsOfPHP/security-advisories/blob/master/smarty/smarty/CVE-2023-28447.yaml web
https://github.com/smarty-php/smarty package
https://lists.debian.org/debian-lts-announce/2024/11/msg00013.html web
https://lists.fedoraproject.org/archives/list/[email protected]/message/HSAUM3YHWHO4UCJXRGRLQGPJAO3MFOZZ web
https://lists.fedoraproject.org/archives/list/[email protected]/message/JBB35GLYTL6JL6EOM6BOZNYP47JKNNHT web
https://lists.fedoraproject.org/archives/list/[email protected]/message/P7O7SKTATM6GAP45S64QFXNLWIY5I7HP web