Skip to content
OpenAdvisories
High USN-6550-1 3 CVEs

postfixadmin vulnerabilities

Published Dec 12, 2023 · Updated Apr 27, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Smarty, that is integrated in the PostfixAdmin
code, was not properly sanitizing user input when generating templates. An
attacker could, through PHP injection, possibly use this issue to execute
arbitrary code. (CVE-2022-29221)

It was discovered that Moment.js, that is integrated in the PostfixAdmin
code, was using an inefficient parsing algorithm when processing date
strings in the RFC 2822 standard. An attacker could possibly use this
issue to cause a denial of service. This issue only affected Ubuntu 22.04
LTS. (CVE-2022-31129)

It was discovered that Smarty, that is integrated in the PostfixAdmin
code, was not properly escaping JavaScript code. An attacker could
possibly use this issue to conduct cross-site scripting attacks (XSS).
(CVE-2023-28447)

Fixed packages 3

ReleasePackageFixed in
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS postfixadmin 3.0.2-2ubuntu0.1~esm1
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS postfixadmin 3.2.1-3ubuntu0.1~esm1
Ubuntu · Pro 22.04 LTS Pro:22.04:LTS postfixadmin 3.3.10-2ubuntu0.1~esm1

Vulnerabilities 3

  • High 8.8
    CVE-2022-29221 Public exploit

    PHP Code Injection by malicious block or filename in Smarty

    Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to versions 3.1.45 and 4.1.1, template authors could inject php code by choosing a malicious {block} name or {include} file name. Sites t…

    smarty-php smarty smarty3 smarty/smarty Debian Ubuntu Packagist
  • High 7.5
    CVE-2022-31129

    Inefficient Regular Expression Complexity in moment

    moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. Affected versions of moment were found to use an inefficient parsing algorithm. Specifically using string-to-date parsing in moment (more specifically rfc2822 par…

    moment moment mediawiki wordpress Debian Ubuntu npm NuGet
  • High 7.1
    CVE-2023-28447 Public exploit

    Cross site scripting vulnerability in Javascript escaping in smarty/smarty

    Smarty is a template engine for PHP. In affected versions smarty did not properly escape javascript code. An attacker could exploit this vulnerability to execute arbitrary JavaScript code in the context of the user's browser session. This may lead to unauthor…

    smarty-php smarty smarty3 smarty/smarty Debian Ubuntu Packagist

References

  • report
    https://ubuntu.com/security/CVE-2022-29221
  • report
    https://ubuntu.com/security/CVE-2022-31129
  • report
    https://ubuntu.com/security/CVE-2023-28447