This affects the package latte/latte before 2.10.6. There is a way to bypass allowFunctions that will affect the security of the application. When the template is set to allow/disallow the use of certain functions, adding control characters (x00-x08) after the function will bypass these restrictions.
References
| Link | Resource |
|---|---|
| https://github.com/nette/latte/commit/227c86eda9a8a6d060ea8501923e768b6d992210 | Patch Third Party Advisory |
| https://github.com/nette/latte/issues/279 | Exploit Issue Tracking Patch Third Party Advisory |
| https://snyk.io/vuln/SNYK-PHP-LATTELATTE-1932226 | Exploit Patch Third Party Advisory |
Configurations
History
27 Dec 2021, 19:33
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : 7.5
v3 : 9.8 |
| CPE | cpe:2.3:a:nette:latte:*:*:*:*:*:*:*:* | |
| CWE | CWE-863 | |
| References | (CONFIRM) https://github.com/nette/latte/issues/279 - Exploit, Issue Tracking, Patch, Third Party Advisory | |
| References | (CONFIRM) https://snyk.io/vuln/SNYK-PHP-LATTELATTE-1932226 - Exploit, Patch, Third Party Advisory | |
| References | (CONFIRM) https://github.com/nette/latte/commit/227c86eda9a8a6d060ea8501923e768b6d992210 - Patch, Third Party Advisory |
17 Dec 2021, 21:15
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | This affects the package latte/latte before 2.10.6. There is a way to bypass allowFunctions that will affect the security of the application. When the template is set to allow/disallow the use of certain functions, adding control characters (x00-x08) after the function will bypass these restrictions. |
17 Dec 2021, 20:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2021-12-17 20:15
Updated : 2024-02-04 22:08
NVD link : CVE-2021-23803
Mitre link : CVE-2021-23803
CVE.ORG link : CVE-2021-23803
JSON object : View
Products Affected
nette
- latte
CWE
CWE-863
Incorrect Authorization