PT-2022-15003
CVE-2022-21648
·
Published
2022-01-04
·
Updated
2022-01-13
Description by
CVSS 3.1
8.2
HighMetricsAV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
Name of the Vulnerable Software and Affected Versions
Latte versions 2.8.0 through 2.8.7
Latte versions 2.9.0 through 2.9.5
Latte versions 2.10.0 through 2.10.7
Description
Latte is an open source template engine for PHP. A sandbox escape exists in the template sandbox, allowing for injection into web pages generated from Latte, which may lead to XSS attacks. The issue affects users who use the sandbox in Latte and templates from untrusted sources.
Recommendations
For versions 2.8.0 through 2.8.7, update to version 2.8.8.
For versions 2.9.0 through 2.9.5, update to version 2.9.6.
For versions 2.10.0 through 2.10.7, update to version 2.10.8.
As a temporary workaround for users unable to upgrade, do not accept template input from untrusted sources.
Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾