Veille CVE
CVE-2021-3129
9.8 Critique Exploitée activement Utilisée par des rançongicielsCatalogue CISA KEV — Laravel Ignition File Upload Vulnerability
Ajoutée le 18/09/2023 · Échéance de correction (agences US) : 09/10/2023
Action requise : Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Description
Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of file_get_contents() and file_put_contents(). This is exploitable on sites using debug mode with Laravel before 8.4.2.
Produits concernés
Scores CVSS
| Version | Score | Source | Vecteur |
|---|---|---|---|
| 3.1 | 9.8 Critique | nvd@nist.gov (NVD) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| 3.1 | 9.8 Critique | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| 2.0 | 7.5 Élevée | nvd@nist.gov (NVD) | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Références
- http://packetstormsecurity.com/files/162094/Ignition-2.5.1-Remote-Code-Execution.html ExploitThird Party AdvisoryVDB Entry
- http://packetstormsecurity.com/files/165999/Ignition-Remote-Code-Execution.html ExploitThird Party AdvisoryVDB Entry
- https://github.com/facade/ignition/pull/334 PatchThird Party Advisory
- https://www.ambionics.io/blog/laravel-debug-rce ExploitThird Party Advisory
- http://packetstormsecurity.com/files/162094/Ignition-2.5.1-Remote-Code-Execution.html ExploitThird Party AdvisoryVDB Entry
- http://packetstormsecurity.com/files/165999/Ignition-Remote-Code-Execution.html ExploitThird Party AdvisoryVDB Entry
- https://github.com/facade/ignition/pull/334 PatchThird Party Advisory
- https://www.ambionics.io/blog/laravel-debug-rce ExploitThird Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-3129 US Government Resource