Medium severity · published Jan 4, 2022
CVE-2022-21648
Latte is an open source template engine for PHP
6.1
CVSS
0.8%
EPSS
No
On KEV
Description
Latte is an open source template engine for PHP. Versions since 2.8.0 Latte has included a template sandbox and in affected versions it has been found that a sandbox escape exists allowing for injection into web pages generated from Latte. This may lead to XSS attacks. The issue is fixed in the versions 2.8.8, 2.9.6 and 2.10.8. Users unable to upgrade should not accept template input from untrusted sources.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 58% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LA
Latte · Nette
2.8.0 before 2.8.8; 2.9.0 before 2.9.6; 2.10.0 before 2.10.8 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-21648
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-21648
Patch
https://github.com/nette/latte/commit/9e1b4f7d70f7a9c3fa6753ffa7d7e450a3d4abb0
Third Party Advisory
https://github.com/nette/latte/security/advisories/GHSA-36m2-8rhx-f36j
More from Latte
9.8
CVE-2021-23803
This affects the package latte/latte before 2.10.6