CVE-2018-8947

Опубликовано: 25 мар. 2018

Источник: nvd

CVSS3: 7.5

CVSS2: 5

EPSS Средний

Описание

rap2hpoutre Laravel Log Viewer before v0.13.0 relies on Base64 encoding for l, dl, and del requests, which makes it easier for remote attackers to bypass intended access restrictions, as demonstrated by reading arbitrary files via a dl request.

Ссылки

https://github.com/rap2hpoutre/laravel-log-viewer/commit/cda89c06dc5331d06fab863d7cb1c4047ad68357
Patch
Third Party Advisory
https://github.com/rap2hpoutre/laravel-log-viewer/releases/tag/v0.13.0
Third Party Advisory
https://www.exploit-db.com/exploits/44343/
Exploit
Third Party Advisory
VDB Entry
https://github.com/rap2hpoutre/laravel-log-viewer/commit/cda89c06dc5331d06fab863d7cb1c4047ad68357
Patch
Third Party Advisory
https://github.com/rap2hpoutre/laravel-log-viewer/releases/tag/v0.13.0
Third Party Advisory
https://www.exploit-db.com/exploits/44343/
Exploit
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:laravel_log_viewer_project:laravel_log_viewer:*:*:*:*:*:*:*:*

Версия до 0.13.0 (исключая)

EPSS

Процентиль: 95%

0.16169

Средний

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-312

Связанные уязвимости

GHSA-63qj-p8gh-5xxx