CVE-2018-8947

moderate-risk
Published 2018-03-25

rap2hpoutre Laravel Log Viewer before v0.13.0 relies on Base64 encoding for l, dl, and del requests, which makes it easier for remote attackers to bypass intended access restrictions, as demonstrated by reading arbitrary files via a dl request.

Do I need to act?

!
16.2% chance of exploitation in next 30 days
EPSS score — higher than 84% of all CVEs
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
!
1 public exploit available
44343
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.5/10 High
NETWORK / LOW complexity

Affected Products (1)

Affected Vendors

Laravel Log Viewer Project

References (6)

Patch https://github.com/rap2hpoutre/laravel-log-viewer/commit/cda89c06dc5331d06fab863...
Third Party Advisory https://github.com/rap2hpoutre/laravel-log-viewer/releases/tag/v0.13.0
Exploit https://www.exploit-db.com/exploits/44343/
Patch https://github.com/rap2hpoutre/laravel-log-viewer/commit/cda89c06dc5331d06fab863...
Third Party Advisory https://github.com/rap2hpoutre/laravel-log-viewer/releases/tag/v0.13.0
Exploit https://www.exploit-db.com/exploits/44343/
44
/ 100
moderate-risk
Severity 26/34 · High
Exploitability 13/34 · Low
Exposure 5/34 · Minimal