CVE-2023-28447

Name	CVE-2023-28447
Description	Smarty is a template engine for PHP. In affected versions smarty did not properly escape javascript code. An attacker could exploit this vulnerability to execute arbitrary JavaScript code in the context of the user's browser session. This may lead to unauthorized access to sensitive user data, manipulation of the web application's behavior, or unauthorized actions performed on behalf of the user. Users are advised to upgrade to either version 3.1.48 or to 4.3.1 to resolve this issue. There are no known workarounds for this vulnerability.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-3956-1
Debian Bugs	1033964, 1033965

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
smarty3 (PTS)	bullseye	3.1.39-2+deb11u1	vulnerable
	bullseye (security)	3.1.39-2+deb11u2	fixed
	bookworm	3.1.47-2	vulnerable
	sid, trixie	3.1.48-2	fixed
smarty4 (PTS)	bookworm	4.3.0-1+deb12u1	fixed
	sid, trixie	4.5.4-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
smarty3	source	bullseye	3.1.39-2+deb11u2	DLA-3956-1
smarty3	source	(unstable)	3.1.48-1		1033964
smarty4	source	bookworm	4.3.0-1+deb12u1
smarty4	source	(unstable)	4.3.1-1		1033965

Notes

[bookworm] - smarty3 <no-dsa> (Minor issue)
[buster] - smarty3 <no-dsa> (Minor issue)
https://github.com/smarty-php/smarty/security/advisories/GHSA-7j98-h7fp-4vwj
https://github.com/smarty-php/smarty/commit/e75165565e9e5956a73365c24d650ba40570ae72 (v4.3.1)
https://github.com/smarty-php/smarty/commit/7677db7bc9a1dcfcad1435fc9d3bac3f295ca3ad (v3.1.48)