GitHub Advisoryadvisory · Packagist

GHSA-63qj-p8gh-5xxx Plaintext Storage of Sensitive Information in Laravel Log Viewer before v0.13.0

HIGH Published 2022-05-13 Modified 2023-07-06 Official page ↗

Aliases: CVE-2018-8947
Ecosystem: Packagist
Packages: rap2hpoutre/laravel-log-viewer
Severity: High
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses: CWE-312
Reviewed: 2023-07-06

Affected packages

• Packagist rap2hpoutre/laravel-log-viewer: < 0.13.0 → fixed in 0.13.0

Description

rap2hpoutre Laravel Log Viewer before v0.13.0 relies on Base64 encoding for l, dl, and del requests, which makes it easier for remote attackers to bypass intended access restrictions, as demonstrated by reading arbitrary files via a dl request.

Related

Alias · CVE (1)

CVE-2018-8947 rap2hpoutre Laravel Log Viewer before v0.13.0 relies on Base64 encoding for l, dl, and del requests, which makes it easier for remote… vulnerability

Weakness · CWE (1)

CWE-312 Cleartext Storage of Sensitive Information weakness

References