PT-2018-18733 · Rap2Hpoutre · Laravel Log Viewer

Rap2Hpoutre · Published 2018-03-25 · Updated 2022-05-13 · CVE-2018-8947

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions rap2hpoutre Laravel Log Viewer versions prior to 0.13.0

Description The issue allows remote attackers to bypass intended access restrictions. This is because the software relies on Base64 encoding for certain requests, making it easier for attackers to exploit. For example, attackers can read arbitrary files via a 'dl' request.

Recommendations For versions prior to 0.13.0, update to version 0.13.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the 'dl' request to minimize the risk of exploitation.

Exploit

Fix

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-312

Related Identifiers

CVE-2018-8947

GHSA-63QJ-P8GH-5XXX

Affected Products

Laravel Log Viewer

References · 6

• 🔥 https://exploit-db.com/exploits/44343 · Exploit
• https://github.com/rap2hpoutre/laravel-log-viewer/commit/cda89c06dc5331d06fab863d7cb1c4047ad68357 · Patch
• https://osv.dev/vulnerability/CVE-2018-8947 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-8947 · Security Note
• https://osv.dev/vulnerability/GHSA-63qj-p8gh-5xxx · Vendor Advisory
• https://github.com/rap2hpoutre/laravel-log-viewer/releases/tag/v0.13.0 · Note