Permissions, Privileges, and Access Controls in Smarty - CVE-2009-5054
Published: February 3, 2011 / Updated: August 11, 2020
Vulnerability identifier: #VU45382
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2009-5054
CWE-ID: CWE-264
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote non-authenticated attacker to read and manipulate data.
Smarty before 3.0.0 beta 4 does not consider the umask value when setting the permissions of files, which might allow attackers to bypass intended access restrictions via standard filesystem operations.
Affected software
Smarty
How to mitigate CVE-2009-5054
Install update from vendor's website.