CVE-2021-23803

2021-12-1720:15:08

Google

osv.dev

6.8 Medium

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

71.0%

JSON

This affects the package latte/latte before 2.10.6. There is a way to bypass allowFunctions that will affect the security of the application. When the template is set to allow/disallow the use of certain functions, adding control characters (x00-x08) after the function will bypass these restrictions.

CPENameOperatorVersion
latteeq2.10.4
latteeq2.4.2
latteeq2.7.0
latteeq2.10.3
latteeq2.9.1
latteeq2.8.1
latteeq2.9.0
latteeq2.3.1
latteeq2.5.1
latteeq2.3.0