Moderate severityNVD Advisory· Published Oct 1, 2012· Updated Apr 29, 2026
CVE-2012-4437
CVE-2012-4437
Description
Cross-site scripting (XSS) vulnerability in the SmartyException class in Smarty (aka smarty-php) before 3.1.12 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors that trigger a Smarty exception.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
smarty/smartyPackagist | < 3.1.12 | 3.1.12 |
Affected products
91cpe:2.3:a:smarty:smarty:1.0:*:*:*:*:*:*:*+ 90 more
- cpe:2.3:a:smarty:smarty:1.0:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:1.0a:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:1.0b:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:1.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:1.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:1.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:1.2.2:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:1.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:1.3.1:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:1.3.2:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:1.4.0:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:1.4.0:b1:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:1.4.0:b2:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:1.4.1:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:1.4.2:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:1.4.3:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:1.4.4:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:1.4.5:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:1.4.6:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:1.5.0:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:1.5.1:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:1.5.2:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:2.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:2.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:2.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:2.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:2.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:2.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:2.3.1:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:2.4.0:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:2.4.1:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:2.4.2:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:2.5.0:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:2.5.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:2.5.0:rc2:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:2.6.0:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:2.6.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:2.6.0:rc2:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:2.6.0:rc3:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:2.6.1:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:2.6.10:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:2.6.11:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:2.6.12:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:2.6.13:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:2.6.14:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:2.6.15:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:2.6.16:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:2.6.17:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:2.6.18:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:2.6.2:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:2.6.20:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:2.6.22:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:2.6.24:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:2.6.25:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:2.6.26:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:2.6.3:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:2.6.4:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:2.6.5:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:2.6.6:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:2.6.7:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:2.6.9:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:3.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:3.0.0:beta4:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:3.0.0:beta5:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:3.0.0:beta6:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:3.0.0:beta7:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:3.0.0:beta8:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:3.0.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:3.0.0:rc2:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:3.0.0:rc3:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:3.0.0:rc4:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:3.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:3.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:3.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:3.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:3.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:3.0.6:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:3.0.7:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:3.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:3.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:3.1.10:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:3.1.11:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:3.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:3.1.3:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:3.1.4:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:3.1.5:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:3.1.6:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:3.1.7:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:3.1.8:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:3.1.9:*:*:*:*:*:*:*
- cpe:2.3:a:smarty:smarty:3.1:rc1:*:*:*:*:*:*
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
19- code.google.com/p/smarty-php/source/detailnvdPatch
- secunia.com/advisories/50589nvdVendor Advisory
- github.com/advisories/GHSA-9gqj-ppv2-f2hqghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2012-4437ghsaADVISORY
- code.google.com/p/smarty-php/source/browse/trunk/distribution/change_log.txtghsaWEB
- code.google.com/p/smarty-php/source/detailghsaWEB
- lists.fedoraproject.org/pipermail/package-announce/2012-September/088138.htmlghsaWEB
- web.archive.org/web/20140201075419/http://www.securityfocus.com/bid/55506ghsaWEB
- www.openwall.com/lists/oss-security/2012/09/19/1ghsaWEB
- www.openwall.com/lists/oss-security/2012/09/20/3ghsaWEB
- advisories.mageia.org/MGASA-2014-0468.htmlnvd
- code.google.com/p/smarty-php/source/browse/trunk/distribution/change_log.txtnvd
- jvn.jp/en/jp/JVN63650108/index.htmlnvd
- jvndb.jvn.jp/ja/contents/2012/JVNDB-2012-000094.htmlnvd
- lists.fedoraproject.org/pipermail/package-announce/2012-September/088138.htmlnvd
- www.mandriva.com/security/advisoriesnvd
- www.openwall.com/lists/oss-security/2012/09/19/1nvd
- www.openwall.com/lists/oss-security/2012/09/20/3nvd
- www.securityfocus.com/bid/55506nvd
News mentions
0No linked articles in our index yet.