GHSA-63qj-p8gh-5xxx

Source

https://github.com/advisories/GHSA-63qj-p8gh-5xxx

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-63qj-p8gh-5xxx/GHSA-63qj-p8gh-5xxx.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-63qj-p8gh-5xxx

Aliases

CVE-2018-8947

Published

2022-05-13T01:53:50Z

Modified

2024-02-16T08:14:42.829714Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

Plaintext Storage of Sensitive Information in Laravel Log Viewer before v0.13.0

Details

rap2hpoutre Laravel Log Viewer before v0.13.0 relies on Base64 encoding for l, dl, and del requests, which makes it easier for remote attackers to bypass intended access restrictions, as demonstrated by reading arbitrary files via a dl request.

Database specific

{
    "nvd_published_at": "2018-03-25T16:29:00Z",
    "cwe_ids": [
        "CWE-312"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2023-07-06T23:31:29Z"
}

References

Affected packages

Packagist / rap2hpoutre/laravel-log-viewer

Package

Name: rap2hpoutre/laravel-log-viewer
Purl: pkg:composer/rap2hpoutre/laravel-log-viewer

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.13.0

Affected versions

v0.*

v0.1.0

v0.1.1

v0.1.2

v0.1.3

v0.1.4

v0.1.5

v0.1.6

v0.1.7

v0.1.8

v0.1.9

v0.1.10

v0.2.0

v0.2.1

v0.2.2

v0.2.3

v0.2.4

v0.2.5

v0.2.6

v0.2.7

v0.2.8

v0.3.0

v0.4.0

v0.4.1

v0.4.2

v0.4.3

v0.5.0

v0.5.1

v0.5.2

v0.5.3

v0.6.0

v0.6.1

v0.7.0

v0.7.1

v0.8.0

v0.8.1

v0.9.0

v0.10.0

v0.10.1

v0.10.2

v0.10.3

v0.10.4

v0.11.0

v0.11.1

v0.11.2

v0.12.0