CVE-2009-1669

Exploit

EPSS 19.48%
Veröffentlicht 18.05.2009 18:30:00
Zuletzt bearbeitet 09.04.2025 00:30:58
Quelle cve@mitre.org
Teams Watchlist Login
Unerledigt Login

The smarty_function_math function in libs/plugins/function.math.php in Smarty 2.6.22 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in the equation attribute of the math function.  NOTE: some of these details are obtained from third party information.

Betroffene Produkte Warnungen 0 Metriken 2 CWE 1 Referenzen 13

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Smarty ≫ Smarty Version2.6.22

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	19.48%	0.949

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	10	10	10	AV:N/AC:L/Au:N/C:C/I:C/A:C

CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

http://osvdb.org/54380

http://secunia.com/advisories/35072

Vendor Advisory

http://secunia.com/advisories/35219

http://www.securityfocus.com/bid/34918

Exploit

http://www.ubuntu.com/usn/usn-791-3

https://exchange.xforce.ibmcloud.com/vulnerabilities/50457

https://www.exploit-db.com/exploits/8659

https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01274.html

https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01283.html

https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01287.html

https://nvd.nist.gov/vuln/detail/CVE-2009-1669

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2009-1669

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2009-1669

EUVD