CVE-2021-23803

Katalog CVE

CVSS 9.8 · Critical EPSS 1,6%

Kerentanan Incorrect Authorization pada nette latte. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

This affects the package latte/latte before 2.10.6. There is a way to bypass allowFunctions that will affect the security of the application. When the template is set to allow/disallow the use of certain functions, adding control characters (x00-x08) after the function will bypass these restrictions.

Rincian

Terbit di NVD

17 Desember 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-863: Incorrect Authorization

EPSS (30 hari)

1,6% peluang dieksploitasi; lebih tinggi dari 75,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/nette/latte/commit/227c86eda9a8a6d060ea8501923e768b6d992210 patch · advisory pihak ketiga
• https://github.com/nette/latte/issues/279 exploit · issue tracking · patch · advisory pihak ketiga
• https://snyk.io/vuln/SNYK-PHP-LATTELATTE-1932226 exploit · patch · advisory pihak ketiga