PT-2019-14926 · Laravel · Voyager

V1Ru55-Appsec · Published 2019-09-30 · Updated 2019-10-04 · CVE-2019-17050

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Voyager package through 1.2.7 for Laravel

Description An issue allows an attacker with admin privileges and Compass access to read or delete arbitrary files, such as the .env file.

Recommendations For Voyager package through 1.2.7, switch off Compass in a production environment as a mitigation measure.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2019-17050

Affected Products

Voyager

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2019-17050 · Security Note
• https://osv.dev/vulnerability/CVE-2019-17050 · Vendor Advisory
• https://github.com/the-control-group/voyager/issues/4322 · Note