CVE-2022-21648
High
Description
Latte is an open source template engine for PHP. Versions since 2.8.0 Latte has included a template sandbox and in affected versions it has been found that a sandbox escape exists allowing for injection into web pages generated from Latte. This may lead to XSS attacks. The issue is fixed in the versions 2.8.8, 2.9.6 and 2.10.8. Users unable to upgrade should not accept template input from untrusted sources.
SeverityHigh
CVSS8.2
Exploit probability—
ProductNette Latte
PublishedJan 4, 2022
First seenJan 4, 2022
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- nette latte2.8.8, 2.9.6, 2.10.8 or later
- latte/latte2.10.8, 2.9.6, 2.8.8 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| nette latte | 2.8.0 ≤ v < 2.8.8, 2.9.0 ≤ v < 2.9.6, 2.10.0 ≤ v < 2.10.8 | 2.8.8, 2.9.6, 2.10.8 |
| latte/lattePackagist | 2.10.0 ≤ v < 2.10.8, 2.9.0 ≤ v < 2.9.6, 2.8.0 ≤ v < 2.8.8 | 2.10.8, 2.9.6, 2.8.8 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.