CVE-2021-21408: debian debian_linux Improper Input Validation
CVSS: 8.8v3.1HighModified
AliasesUBUNTU-CVE-2021-21408DEBIAN-CVE-2021-21408
Published 10-01-2022Last modified 23-04-2025
Vulnerability summary
CVE-2021-21408 is a high (CVSS 8.8) Improper Input Validation vulnerability in debian debian_linux. EPSS estimates a 2.22% chance of exploitation in the next 30 days, higher than 82.4% of scored vulnerabilities.
CVSS score
8.8/10
010
High · v3.1 (CVE.org)EPSS score
2.22%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 6 · Related 3Timeline
- 10-01-2022PublishedVulnerability first disclosed.
- 23-04-2025Last modifiedVulnerability information updated.
Description
Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to versions 3.1.43 and 4.0.3, template authors could run restricted static php methods. Users should upgrade to version 3.1.43 or 4.0.3 to receive a patch.
CVSS metrics
5 scores · 4 sources · 2 versionsHigh 8.8Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HSourcesAll 4 agree
- OSV · UbuntuEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- NVDNIST8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Medium 6.5Preferred score · NVD (NIST)
AV:N/AC:L/Au:S/C:P/I:P/A:PSourcesSingle source
EPSS trend
Probability
2.22%
Chance of exploitation in the next 30 days
Percentile
82%
Versus all other CVEs
30-day change
0.00 pp
From 2.22% on 20-09-2026
20-09-202620-10-2026
EPSS score2.22%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Debian3 products
- smarty3< 3.1.45-1
- smarty4< 4.1.1-1
- debian_linuxEOL9.0 | 10.0 | 11.0
Fedoraproject1 product
- fedoraEOL36 | 37
Smarty1 product
- smarty< 3.1.43 | ≥ 4.0.0, < 4.0.3
Smarty-php1 product
- smarty< 3.1.43 | ≥ 4.0.0, < 4.0.3
Ubuntu1 product
- smarty3< 3.1.21-1ubuntu1+esm1 | < 3.1.31+20161214.1.c7d42e4+selfpack1-3ubuntu0.1 | < 3.1.34+20190228.1.c9f0de05+selfpack1-1ubuntu0.1~esm1 | < 3.1.39-2ubuntu1
5 vendors · 7 products
References
15 links- github.com/smarty-php/smarty/commit/19ae410bf56007a5ef24441cdc6414619cfaf664REPORTPatchThird Party Advisory
- lists.fedoraproject.org/archives/…Vendor Advisory
- lists.fedoraproject.org/archives/…Vendor Advisory