PT-2022-15003 · Latte · Latte

Jinyitong + 1 · Published 2022-01-04 · Updated 2022-01-13 · CVE-2022-21648

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Latte versions 2.8.0 through 2.8.7 Latte versions 2.9.0 through 2.9.5 Latte versions 2.10.0 through 2.10.7

Description Latte is an open source template engine for PHP. A sandbox escape exists in the template sandbox, allowing for injection into web pages generated from Latte, which may lead to XSS attacks. The issue affects users who use the sandbox in Latte and templates from untrusted sources.

Recommendations For versions 2.8.0 through 2.8.7, update to version 2.8.8. For versions 2.9.0 through 2.9.5, update to version 2.9.6. For versions 2.10.0 through 2.10.7, update to version 2.10.8. As a temporary workaround for users unable to upgrade, do not accept template input from untrusted sources.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-21648

GHSA-36M2-8RHX-F36J

Affected Products

Latte

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/21xxx/CVE-2022-21648.json · Exploit
• https://github.com/nette/latte/commit/9e1b4f7d70f7a9c3fa6753ffa7d7e450a3d4abb0 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-21648 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-21648 · Security Note
• https://osv.dev/vulnerability/CVE-2022-21648 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-36m2-8rhx-f36j · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-21648 · Security Note
• https://ubuntu.com/security/CVE-2022-21648 · Vendor Advisory
• https://github.com/nette/latte · Note
• https://github.com/nette/latte/security/advisories/GHSA-36m2-8rhx-f36j · Note
• https://t.me/cvenotify/25423 · Telegram Post
• https://t.me/cibsecurity/34955 · Telegram Post