GitHub Advisoryadvisory · Packagist

GHSA-6pj2-5fqq-xvjc Incorrect Authorization in latte/latte

CRITICAL Published 2022-01-06 Modified 2022-01-06 Official page ↗
Aliases
CVE-2021-23803
Ecosystem
Packagist
Packages
latte/latte
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-863
Reviewed
2022-01-06

Affected packages

• Packagist latte/latte: < 2.10.6 → fixed in 2.10.6

Description

This affects the package latte/latte before 2.10.6. There is a way to bypass allowFunctions that will affect the security of the application. When the template is set to allow/disallow the use of certain functions, adding control characters (x00-x08) after the function will bypass these restrictions.

Related

Alias · CVE (1)

  • CVE-2021-23803 This affects the package latte/latte before 2.10.6. vulnerability

Weakness · CWE (1)

  • CWE-863 Incorrect Authorization weakness

References