PT-2019-14926 · Laravel · Voyager

V1Ru55-Appsec · Publicado 2019-09-30 · Atualizado 2019-10-04 · CVE-2019-17050

Positive Technologies (AI Summary)

CVSS v3.1

7.2

Alta

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Voyager package through 1.2.7 for Laravel

Description An issue allows an attacker with admin privileges and Compass access to read or delete arbitrary files, such as the .env file.

Recommendations For Voyager package through 1.2.7, switch off Compass in a production environment as a mitigation measure.

Correção

IDOR

Enumeração de Fraquezas

CWE-639

Identificadores relacionados

CVE-2019-17050

Produtos afetados

Voyager

Referências · 3

• https://github.com/the-control-group/voyager/issues/4322 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-17050 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-17050 · Aviso do Fabricante