VIR Vulnerability Intelligence Relay

CVE-2012-4277

medium
Published 2012-08-13 · Modified 2026-04-29
💬 Discuss on Community ✚ Propose mitigation
CVSS v3
—
CVSS v4 NEW
—
not yet in upstream
VIR risk
4.3

Description

Cross-site scripting (XSS) vulnerability in the smarty_function_html_options_optoutput function in distribution/libs/plugins/function.html_options.php in Smarty before 3.1.8 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Predictions

Exploit likelihood
20%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

No mitigations published for this CVE yet.

The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.

✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here with source_tier=community-verified.

OS impact
OSVersionStatusFixed in
debian debianbookwormfixed3.1.10-1
debian debianbullseyefixed3.1.10-1
debian debianforkyfixed3.1.10-1
debian debiansidfixed3.1.10-1
debian debiantrixiefixed3.1.10-1

Application impact
VendorProductVersionsFixed
smartysmarty{"endIncluding":"3.1.7"}
smartysmarty1.0
smartysmarty1.0a
smartysmarty1.0b
smartysmarty1.1.0
smartysmarty1.2.0
smartysmarty1.2.1
smartysmarty1.2.2
smartysmarty1.3.0
smartysmarty1.3.1
smartysmarty1.3.2
smartysmarty1.4.0
smartysmarty1.4.1
smartysmarty1.4.2
smartysmarty1.4.3
smartysmarty1.4.4
smartysmarty1.4.5
smartysmarty1.4.6
smartysmarty1.5.0
smartysmarty1.5.1
smartysmarty1.5.2
smartysmarty2.0.0
smartysmarty2.0.1
smartysmarty2.1.0
smartysmarty2.1.1
smartysmarty2.2.0
smartysmarty2.3.0
smartysmarty2.3.1
smartysmarty2.4.0
smartysmarty2.4.1
smartysmarty2.4.2
smartysmarty2.5.0
smartysmarty2.6.0
smartysmarty2.6.1
smartysmarty2.6.2
smartysmarty2.6.3
smartysmarty2.6.4
smartysmarty2.6.5
smartysmarty2.6.6
smartysmarty2.6.7
smartysmarty2.6.9
smartysmarty2.6.10
smartysmarty2.6.11
smartysmarty2.6.12
smartysmarty2.6.13
smartysmarty2.6.14
smartysmarty2.6.15
smartysmarty2.6.16
smartysmarty2.6.17
smartysmarty2.6.18
smartysmarty2.6.20
smartysmarty2.6.22
smartysmarty2.6.24
smartysmarty2.6.25
smartysmarty2.6.26
smartysmarty3.0.0
smartysmarty3.0.1
smartysmarty3.0.2
smartysmarty3.0.3
smartysmarty3.0.4
smartysmarty3.0.5
smartysmarty3.0.6
smartysmarty3.0.7
smartysmarty3.1
smartysmarty3.1.0
smartysmarty3.1.1
smartysmarty3.1.2
smartysmarty3.1.3
smartysmarty3.1.4
smartysmarty3.1.5
smartysmarty3.1.6

References

CWEs

CWE-79

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.