Smarty CVE-2012-4277 Cross-Site Scripting Vulnerability

Bugtraq ID:	73877
Class:	Input Validation Error
CVE:	CVE-2012-4277
Remote:	Yes
Local:	No
Published:	Aug 13 2012 12:00AM
Updated:	Aug 13 2012 12:00AM
Credit:	Unknown
Vulnerable:	Smarty Smarty 3.0 rc4 Smarty Smarty 3.0 RC3 Smarty Smarty 3.0 rc2 Smarty Smarty 3.0 RC1 Smarty Smarty 3.0 beta8 Smarty Smarty 3.0 beta7 Smarty Smarty 3.0 beta6 Smarty Smarty 3.0 beta5 Smarty Smarty 3.0 beta4 Smarty Smarty 2.6.24 Smarty Smarty 2.6.22 Smarty Smarty 2.6.20 Smarty Smarty 2.6.18 Smarty Smarty 2.6.17 Smarty Smarty 2.6.16 Smarty Smarty 2.6.15 Smarty Smarty 2.6.14 Smarty Smarty 3.1.7 Smarty Smarty 3.1.6 Smarty Smarty 3.1.5 Smarty Smarty 3.1.4 Smarty Smarty 3.1.3 Smarty Smarty 3.1.2 Smarty Smarty 3.1.1 Smarty Smarty 3.1.0 Smarty Smarty 3.1 Rc1 Smarty Smarty 3.0.7 Smarty Smarty 3.0.6 Smarty Smarty 3.0.5 Smarty Smarty 3.0.4 Smarty Smarty 3.0.3 Smarty Smarty 3.0.2 Smarty Smarty 3.0.1 Smarty Smarty 3.0.0 Smarty Smarty 2.6.9 Smarty Smarty 2.6.7 Smarty Smarty 2.6.6 Smarty Smarty 2.6.5 Smarty Smarty 2.6.4 Smarty Smarty 2.6.3 Smarty Smarty 2.6.26 Smarty Smarty 2.6.25 Smarty Smarty 2.6.2 Smarty Smarty 2.6.13 Smarty Smarty 2.6.12 Smarty Smarty 2.6.11 Smarty Smarty 2.6.10 Smarty Smarty 2.6.1 Smarty Smarty 2.6.0 Rc3 Smarty Smarty 2.6.0 Rc2 Smarty Smarty 2.6.0 Rc1 Smarty Smarty 2.6.0 Smarty Smarty 2.5.0 Rc2 Smarty Smarty 2.5.0 Rc1 Smarty Smarty 2.5.0 Smarty Smarty 2.4.2 Smarty Smarty 2.4.1 Smarty Smarty 2.4.0 Smarty Smarty 2.3.1 Smarty Smarty 2.3.0 Smarty Smarty 2.2.0 Smarty Smarty 2.1.1 Smarty Smarty 2.1.0 Smarty Smarty 2.0.1 Smarty Smarty 2.0.0 Smarty Smarty 1.5.2 Smarty Smarty 1.5.1 Smarty Smarty 1.5.0 Smarty Smarty 1.4.6 Smarty Smarty 1.4.5 Smarty Smarty 1.4.4 Smarty Smarty 1.4.3 Smarty Smarty 1.4.2 Smarty Smarty 1.4.1 Smarty Smarty 1.4.0 B2 Smarty Smarty 1.4.0 B1 Smarty Smarty 1.4.0 Smarty Smarty 1.3.2 Smarty Smarty 1.3.1 Smarty Smarty 1.3.0 Smarty Smarty 1.2.2 Smarty Smarty 1.2.1 Smarty Smarty 1.2.0 Smarty Smarty 1.1.0 Smarty Smarty 1.0b Smarty Smarty 1.0A Smarty Smarty 1.0
Not Vulnerable:

Smarty CVE-2012-4277 Cross-Site Scripting Vulnerability

Smarty is prone to a cross-site scripting vulnerability. Cross-site scripting (XSS) vulnerability in the smarty_function_html_options_optoutput function in distribution/libs/plugins/function.html_options.php in Smarty before 3.1.8 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Smarty CVE-2012-4277 Cross-Site Scripting Vulnerability

An attacker can exploit this issue by enticing an unsuspecting victim to follow a malicious URI.

Smarty CVE-2012-4277 Cross-Site Scripting Vulnerability

References:

• Issue 98: XSS in html_options (ikehiroki )
  
• r4612 - smarty-php - Smarty Template Language for PHP - Google Projec (CONFIRM)
  
• Smarty Change Log (New Digital Group)
  
• Smarty Input Validation Flaw in {html_options} Function Plugin Permits Cross-Sit (SECTRACK)