PT-2024-40382 · Unknown · Endroid/Qr-Code-Bundle

Published 2024-05-15 · Updated 2024-05-15

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions endroid/qr-code-bundle versions prior to 3.4.2

Description The issue arises from the improper handling of non-image data as the logo, which could lead to unintended file disclosure through the logo path query parameter.

Recommendations For versions prior to 3.4.2, update to version 3.4.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the logo path query parameter to minimize the risk of exploitation.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

GHSA-MVF6-3F2G-XFXF

Affected Products

Endroid/Qr-Code-Bundle

References · 5

• https://osv.dev/vulnerability/GHSA-mvf6-3f2g-xfxf · Vendor Advisory
• https://github.com/FriendsOfPHP/security-advisories/blob/master/endroid/qr-code-bundle/2019-12-22.yaml · Note
• https://github.com/endroid/qr-code-bundle · Note
• https://github.com/endroid/qr-code-bundle/releases/tag/3.4.2 · Note
• https://github.com/endroid/qr-code-bundle/commit/51928eaaa30e7db1fd3f1076744dcbc8f8cec8c8 · Note