CVE-2021-3129

Warnung

Exploit

EPSS 94.29%
Veröffentlicht 12.01.2021 15:15:16
Zuletzt bearbeitet 10.11.2025 14:39:03
Quelle cve@mitre.org
CVE-Watchlists
Login
Unerledigt
Login

Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of file_get_contents() and file_put_contents(). This is exploitable on sites using debug mode with Laravel before 8.4.2.

Betroffene Produkte Warnungen 1 Metriken 4 CWE 0 Referenzen 8

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Facade ≫ Ignition SwPlatformlaravel Version < 2.5.2

Laravel ≫ Laravel Version < 8.4.2

18.09.2023: CISA Known Exploited Vulnerabilities (KEV) Catalog

Laravel Ignition File Upload Vulnerability

Schwachstelle

Laravel Ignition contains a file upload vulnerability that allows unauthenticated remote attackers to execute malicious code due to insecure usage of file_get_contents() and file_put_contents().

Beschreibung

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Erforderliche Maßnahmen

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	94.29%	0.999

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	9.8	3.9	5.9	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov	7.5	10	6.4	AV:N/AC:L/Au:N/C:P/I:P/A:P
134c704f-9b21-4f2e-91b3-4a467353bcc0	9.8	3.9	5.9	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H