CVE-2018-8947

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

rap2hpoutre Laravel Log Viewer before v0.13.0 relies on Base64 encoding for l, dl, and del requests, which makes it easier for remote attackers to bypass intended access restrictions, as demonstrated by reading arbitrary files via a dl request.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-312

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/rap2hpoutre/laravel-log-viewer/commit/cda89c06dc5331d06fab863d7cb1c4047ad68357Patch, Third Party Advisory
https://github.com/rap2hpoutre/laravel-log-viewer/releases/tag/v0.13.0Third Party Advisory
https://www.exploit-db.com/exploits/44343/Exploit, Third Party Advisory, VDB Entry
https://github.com/rap2hpoutre/laravel-log-viewer/commit/cda89c06dc5331d06fab863d7cb1c4047ad68357Patch, Third Party Advisory
https://github.com/rap2hpoutre/laravel-log-viewer/releases/tag/v0.13.0Third Party Advisory
https://www.exploit-db.com/exploits/44343/Exploit, Third Party Advisory, VDB Entry

Timeline

Published: Mar 25, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-89486.1In MISP before 2.4.89, app/View/Events/resolved_attributes.ctp has multiple XSS issues via a malicious MISP module.CVE-2018-89494.3An issue was discovered in app/Model/Attribute.php in MISP before 2.4.89. There is a critical API integrity bug, potentially allowing users CVE-2018-89538.8CA Workload Automation AE before r11.3.6 SP7 allows remote attackers to a perform SQL injection via a crafted HTTP request.CVE-2018-89549.8CA Workload Control Center before r11.4 SP6 allows remote attackers to execute arbitrary code via a crafted HTTP request.CVE-2018-89559.8The installer for BitDefender GravityZone relies on an encoded string in a filename to determine the URL for installation metadata, which al CVE-2018-89565.3ntpd in ntp 4.2.8p10, 4.2.8p11, 4.2.8p12 and 4.2.8p13 allow remote attackers to prevent a broadcast client from synchronizing its clock with CVE-2018-89575.4CoverCMS v1.1.6 has XSS via the fourth input box to index.php, related to admina/mconfigs.inc.php.CVE-2018-89608.8The ReadTIFFImage function in coders/tiff.c in ImageMagick 7.0.7-26 Q16 does not properly restrict memory allocation, leading to a heap-base CVE-2018-89616.5In libming 0.4.8, the decompilePUSHPARAM function of decompile.c has a use-after-free. Remote attackers could leverage this vulnerability to CVE-2018-89626.5In libming 0.4.8, the decompileSingleArgBuiltInFunctionCall function of decompile.c has a use-after-free. Remote attackers could leverage th CVE-2018-89636.5In libming 0.4.8, the decompileGETVARIABLE function of decompile.c has a use-after-free. Remote attackers could leverage this vulnerability CVE-2018-89646.5In libming 0.4.8, the decompileDELETE function of decompile.c has a use-after-free. Remote attackers could leverage this vulnerability to ca