GitHub Advisoryadvisory · Packagist

GHSA-fp63-499m-hq6m Files or Directories Accessible to External Parties in ether/logs

HIGH Published 2021-07-12 Modified 2021-07-09 Official page ↗
Aliases
CVE-2021-32752
Ecosystem
Packagist
Packages
ether/logs
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-552
Reviewed
2021-07-09

Affected packages

• Packagist ether/logs: < 3.0.4 → fixed in 3.0.4

Description

Impact A vulnerability was found that allowed authenticated admin users to access any file on the server. Patches The vulnerability has been fixed in 3.0.4. Workarounds We recommend disabling the plugin if untrustworthy sources have admin access. For more information If you have any questions or comments about this advisory: • Open an issue in ether/logs

Related

Alias · CVE (1)

  • CVE-2021-32752 Ether Logs is a package that allows one to check one's logs in the Craft 3 utilities section. vulnerability

Weakness · CWE (1)

  • CWE-552 Files or Directories Accessible to External Parties weakness

References