7.5high
CVE-2018-8947in critical feed1 exploit
Plaintext Storage of Sensitive Information in Laravel Log Viewer before v0.13.0
Also known as GHSA-63qj-p8gh-5xxx
Published 8 y ago · modified 4 mo ago · JSON
CVSS
7.5
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
11.0%
percentile 96%
Public exploits
1
Exploit-DB
Summary
rap2hpoutre Laravel Log Viewer before v0.13.0 relies on Base64 encoding for l, dl, and del requests, which makes it easier for remote attackers to bypass intended access restrictions, as demonstrated by reading arbitrary files via a dl request.
Exploit prediction (EPSS)
11.02% probability of exploitation in the next 30 days, higher than 96% of all scored CVEs.
Exploits and detections
- EDB-44343 Laravel Log Viewer < 0.13.0 - Local File Download · webapps · 2018-03-26
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 7.5 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N |
| GitHub | 3.0 | 7.5 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| packagist | rap2hpoutre/laravel-log-viewer | <0.13.0 | 0.13.0 |
Classification
- Weakness
- CWE-312 Cleartext Storage of Sensitive Information
References
- github.com /rap2hpoutre/laravel-log-viewer/commit/cda89c06dc5331d06fab863d7cb1c4047ad68357 · x_refsource_MISC, x_transferred
- github.com /rap2hpoutre/laravel-log-viewer/releases/tag/v0.13.0 · x_refsource_MISC, x_transferred
- exploit-db.com /exploits/44343/ · exploit, x_refsource_EXPLOIT-DB, x_transferred
- nvd.nist.gov /vuln/detail/CVE-2018-8947 · advisory
- exploit-db.com /exploits/44343 · web
Sources
- CVE List: CVE-2018-8947
- GitHub Advisory: GHSA-63qj-p8gh-5xxx
- NVD: CVE-2018-8947
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.