NVD

Id
35428  
Name
CVE-2014-8350  
Description
Smarty before 3.1.21 allows remote attackers to bypass the secure mode restrictions and execute arbitrary PHP code as demonstrated by "{literal}<{/literal}script language=php>" in a template.  
Reject
 
CVSS Version
2  
CVSS Score
7.5  
Severity
High  
CVSS Base Score
7.5  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-19  
Published
2014-11-03  
Modified Date
2015-09-10  
Seq
2014-8350  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
181613 35428 CVE-2014-8350 http://advisories.mageia.org/MGASA-2014-0468.html  View
181614 35428 CVE-2014-8350 [oss-security] 20141022 CVE Request: smarty: secure mode bypass  View
181615 35428 CVE-2014-8350 [oss-security] 20141023 Re: CVE Request: smarty: secure mode bypass  View
181616 35428 CVE-2014-8350 MDVSA-2014:221  View
181617 35428 CVE-2014-8350 70708  View
181618 35428 CVE-2014-8350 smarty-cve20148350-code-exec(97725)  View
181619 35428 CVE-2014-8350 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=765920  View
181620 35428 CVE-2014-8350 https://code.google.com/p/smarty-php/source/browse/trunk/distribution/change_log.txt?r=4902  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
16324 JVNDB-2014-005199 Smarty におけるセキュアモードの制限を回避される脆弱性 Smarty には、セキュアモードの制限を回避され、任意の PHP コードを実行される脆弱性が存在します。 CVE-2014-8350 75643 CVE-2014-8350 35428 7.5 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-005199.html 2014-10-18 2015-06-08 View