Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS1nODU3LTQ3cG0tM3IzMs4AAx2X
laravel-admin has Arbitrary File Upload vulnerability
An arbitrary file upload vulnerability in laravel-admin v1.8.19 allows attackers to execute arbitrary code via a crafted PHP file.
Permalink: https://github.com/advisories/GHSA-g857-47pm-3r32JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1nODU3LTQ3cG0tM3IzMs4AAx2X
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: about 1 year ago
Updated: about 1 year ago
CVSS Score: 7.2
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Identifiers: GHSA-g857-47pm-3r32, CVE-2023-24249
References:
- https://nvd.nist.gov/vuln/detail/CVE-2023-24249
- https://flyd.uk/post/cve-2023-24249/
- https://laravel-admin.org/
- https://github.com/z-song/laravel-admin/issues/5726
- https://github.com/advisories/GHSA-g857-47pm-3r32
Blast Radius: 24.7
Affected Packages
packagist:encore/laravel-admin
Dependent packages: 514Dependent repositories: 2,708
Downloads: 2,389,640 total
Affected Version Ranges: <= 1.8.19
No known fixed version
All affected versions: 1.1.6, 1.2.6, 1.2.8, 1.2.9, 1.2.10, 1.3.3, 1.3.4, 1.4.1, 1.4.4, 1.4.5, 1.4.6, 1.5.5, 1.5.6, 1.5.7, 1.5.8, 1.5.9, 1.5.10, 1.5.11, 1.5.12, 1.5.13, 1.5.14, 1.5.15, 1.5.16, 1.5.17, 1.5.18, 1.5.19, 1.6.0, 1.6.1, 1.6.2, 1.6.3, 1.6.4, 1.6.5, 1.6.6, 1.6.7, 1.6.8, 1.6.9, 1.6.10, 1.6.11, 1.6.12, 1.6.13, 1.6.14, 1.6.15, 1.7.0, 1.7.1, 1.7.2, 1.7.3, 1.7.4, 1.7.5, 1.7.6, 1.7.7, 1.7.8, 1.7.9, 1.7.11, 1.7.12, 1.7.13, 1.7.14, 1.7.15, 1.7.16, 1.8.0, 1.8.1, 1.8.2, 1.8.3, 1.8.4, 1.8.5, 1.8.6, 1.8.9, 1.8.10, 1.8.11, 1.8.12, 1.8.13, 1.8.14, 1.8.15, 1.8.16, 1.8.17, 1.8.18, 1.8.18, 1.8.19