GHSA-6m9f-8vwq-97pm

ghsaUSosv

Smarty Does Not Consider Umask Values When Setting Permissions

view advisory published 2022-05-02Licence: CC-BY-4.0

Smarty before 3.0.0 beta 4 does not consider the umask value when setting the permissions of files, which might allow attackers to bypass intended access restrictions via standard filesystem operations.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2009-5054US	high7.5	1.59% (75th)	—	2011-02-03
Smarty before 3.0.0 beta 4 does not consider the umask value when setting the permissions of files, which might allow attackers to bypass intended access restrictions via standard…

references

External citations — patches, advisories, analysis.

https://github.com/smarty-php/smartyPACKAGE
https://nvd.nist.gov/vuln/detail/CVE-2009-5054ADVISORY
https://web.archive.org/web/20101116174040/http://smarty-php.googlecode.com/svn/trunk/distribution/change_log.txtWEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan