HIGH🇬🇧 English

CVE-2019-17050

CVSS 7.2v3.1pub. 2019-09-30upd. 2024-11-21

An issue was discovered in the Voyager package through 1.2.7 for Laravel. An attacker with admin privileges and Compass access can read or delete arbitrary files, such as the .env file. NOTE: a software maintainer has suggested a solution in which Compass is switched off in a production environment.

oryginał EN
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

  • Thecontrolgroup Voyager

    APP
    Thecontrolgroup
    ≤ 1.2.7
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
CWE
Referencje

Powiązane podatności

CVE-2020-36070CRITICAL9.8ten sam produkt

Insecure Permission vulnerability found in Yoyager v.1.4 and before allows a remote attacker to execute arbitr...

CVE-2024-55415MEDIUM5.7ten sam produkt

DevDojo Voyager through 1.8.0 is vulnerable to path traversal at the /admin/compass.

CVE-2024-55417MEDIUM4.3ten sam produkt

DevDojo Voyager through version 1.8.0 is vulnerable to bypassing the file type verification when an authentica...

CVE-2024-55416LOW3.5ten sam produkt

DevDojo Voyager through version 1.8.0 is vulnerable to reflected XSS via /admin/compass. By manipulating an au...