CVE-2018-8947 Plaintext Storage of Sensitive Information in Laravel Log Viewer before v0.13.0
HighCVSS 7.5
EPSS 11.0%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
rap2hpoutre Laravel Log Viewer before v0.13.0 relies on Base64 encoding for l, dl, and del requests, which makes it easier for remote attackers to bypass intended access restrictions, as demonstrated by reading arbitrary files via a dl request.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| rap2hpoutre/laravel-log-viewer(Packagist) | < 0.13.0 | 0.13.0 |
| rap2hpoutre/laravel-log-viewer(Packagist) | = v0.1.0 | No fix listed |
| rap2hpoutre/laravel-log-viewer(Packagist) | = v0.1.1 | No fix listed |
| rap2hpoutre/laravel-log-viewer(Packagist) | = v0.1.10 | No fix listed |
| rap2hpoutre/laravel-log-viewer(Packagist) | = v0.1.2 | No fix listed |
| rap2hpoutre/laravel-log-viewer(Packagist) | = v0.1.3 | No fix listed |
| rap2hpoutre/laravel-log-viewer(Packagist) | = v0.1.4 | No fix listed |
| rap2hpoutre/laravel-log-viewer(Packagist) | = v0.1.5 | No fix listed |
| rap2hpoutre/laravel-log-viewer(Packagist) | = v0.1.6 | No fix listed |
| rap2hpoutre/laravel-log-viewer(Packagist) | = v0.1.7 | No fix listed |
| rap2hpoutre/laravel-log-viewer(Packagist) | = v0.1.8 | No fix listed |
| rap2hpoutre/laravel-log-viewer(Packagist) | = v0.1.9 | No fix listed |
| rap2hpoutre/laravel-log-viewer(Packagist) | = v0.10.0 | No fix listed |
| rap2hpoutre/laravel-log-viewer(Packagist) | = v0.10.1 | No fix listed |
| rap2hpoutre/laravel-log-viewer(Packagist) | = v0.10.2 | No fix listed |
| rap2hpoutre/laravel-log-viewer(Packagist) | = v0.10.3 | No fix listed |
| rap2hpoutre/laravel-log-viewer(Packagist) | = v0.10.4 | No fix listed |
| rap2hpoutre/laravel-log-viewer(Packagist) | = v0.11.0 | No fix listed |
| rap2hpoutre/laravel-log-viewer(Packagist) | = v0.11.1 | No fix listed |
| rap2hpoutre/laravel-log-viewer(Packagist) | = v0.11.2 | No fix listed |
| rap2hpoutre/laravel-log-viewer(Packagist) | = v0.12.0 | No fix listed |
| rap2hpoutre/laravel-log-viewer(Packagist) | = v0.2.0 | No fix listed |
| rap2hpoutre/laravel-log-viewer(Packagist) | = v0.2.1 | No fix listed |
| rap2hpoutre/laravel-log-viewer(Packagist) | = v0.2.2 | No fix listed |
| rap2hpoutre/laravel-log-viewer(Packagist) | = v0.2.3 | No fix listed |
Show 22 more
| Product | Affected versions | Fixed in |
|---|---|---|
| rap2hpoutre/laravel-log-viewer(Packagist) | = v0.2.4 | No fix listed |
| rap2hpoutre/laravel-log-viewer(Packagist) | = v0.2.5 | No fix listed |
| rap2hpoutre/laravel-log-viewer(Packagist) | = v0.2.6 | No fix listed |
| rap2hpoutre/laravel-log-viewer(Packagist) | = v0.2.7 | No fix listed |
| rap2hpoutre/laravel-log-viewer(Packagist) | = v0.2.8 | No fix listed |
| rap2hpoutre/laravel-log-viewer(Packagist) | = v0.3.0 | No fix listed |
| rap2hpoutre/laravel-log-viewer(Packagist) | = v0.4.0 | No fix listed |
| rap2hpoutre/laravel-log-viewer(Packagist) | = v0.4.1 | No fix listed |
| rap2hpoutre/laravel-log-viewer(Packagist) | = v0.4.2 | No fix listed |
| rap2hpoutre/laravel-log-viewer(Packagist) | = v0.4.3 | No fix listed |
| rap2hpoutre/laravel-log-viewer(Packagist) | = v0.5.0 | No fix listed |
| rap2hpoutre/laravel-log-viewer(Packagist) | = v0.5.1 | No fix listed |
| rap2hpoutre/laravel-log-viewer(Packagist) | = v0.5.2 | No fix listed |
| rap2hpoutre/laravel-log-viewer(Packagist) | = v0.5.3 | No fix listed |
| rap2hpoutre/laravel-log-viewer(Packagist) | = v0.6.0 | No fix listed |
| rap2hpoutre/laravel-log-viewer(Packagist) | = v0.6.1 | No fix listed |
| rap2hpoutre/laravel-log-viewer(Packagist) | = v0.7.0 | No fix listed |
| rap2hpoutre/laravel-log-viewer(Packagist) | = v0.7.1 | No fix listed |
| rap2hpoutre/laravel-log-viewer(Packagist) | = v0.8.0 | No fix listed |
| rap2hpoutre/laravel-log-viewer(Packagist) | = v0.8.1 | No fix listed |
| rap2hpoutre/laravel-log-viewer(Packagist) | = v0.9.0 | No fix listed |
| laravel log viewer project laravel log viewer | < 0.13.0 | 0.13.0 |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch third-party-advisory
- github.com third-party-advisory
- 44343 exploit third-party-advisory vdb-entry
- github.com