CVE-2018-8947

rap2hpoutre Laravel Log Viewer before v0.13.0 relies on Base64 encoding for l, dl, and del requests, which makes it easier for remote attackers to bypass intended access restrictions, as demonstrated by reading arbitrary files via a dl request.

Score

CVSS 3.0 7.5 High

Status

Modified - cve@mitre.org

Published

2018-03-25

Last modified

2024-08-05

Weaknesses

CWE-312

Affected products

• Laravel Log Viewer (Laravel Log Viewer Project)

References

• https://github.com/rap2hpoutre/laravel-log-viewer/commit/cda89c06dc5331d06fab863d7cb1c4047ad68357
• https://github.com/rap2hpoutre/laravel-log-viewer/releases/tag/v0.13.0
• https://www.exploit-db.com/exploits/44343/