Описание
Livewire Filemanager, commonly used in Laravel applications, contains LivewireFilemanagerComponent.php, which does not perform file type and MIME validation, allowing for RCE through upload of a malicious php file that can then be executed via the /storage/ URL if a commonly performed setup process within Laravel applications has been completed.
Ссылки
- Product
- Not Applicable
- Third Party Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 1.0.0 (исключая)
cpe:2.3:a:livewire-filemanager:filemanager:*:*:*:*:*:*:*:*
EPSS
Процентиль: 12%
0.00039
Низкий
9.8 Critical
CVSS3
7.5 High
CVSS3
Дефекты
CWE-434
Связанные уязвимости
CVSS3: 7.5
github
19 дней назад
Livewire Filemanager does not restrict uploaded file types
CVSS3: 9.8
fstec
19 дней назад
Уязвимость компонента LivewireFilemanagerComponent.php файлового менеджера Livewire Filemanager, позволяющая нарушителю выполнить пролизвольный код
EPSS
Процентиль: 12%
0.00039
Низкий
9.8 Critical
CVSS3
7.5 High
CVSS3
Дефекты
CWE-434