CyberSec.Space Logo
Back to CVE Browser

CVE-2021-43996

CRITICAL
9.8
CVSS Severity Score
EPSS Score0.0360%
EPSS Percentile12.11th
PublishedNov 17, 2021
Last ModifiedNov 21, 2024

Vulnerability Description

The Ignition component before 1.16.15, and 2.0.x before 2.0.6, for Laravel has a "fix variable names" feature that can lead to incorrect access control.

Affected Platforms (CPE)

📦
Facade

Ignition

< 1.6.15
📦
Facade

Ignition

>= 2.0.0 and < 2.0.6

References & Advisories

🔗 https://github.com/facade/ignition/compare/1.16.14...1.16.15
🔗 https://github.com/facade/ignition/compare/2.0.5...2.0.6
🔗 https://github.com/facade/ignition/pull/285
🔗 https://github.com/facade/ignition/compare/1.16.14...1.16.15
🔗 https://github.com/facade/ignition/compare/2.0.5...2.0.6
🔗 https://github.com/facade/ignition/pull/285

Related Vulnerabilities

CVE-2006-515110.0

Unspecified vulnerability in HP Ignite-UX server before C.6.9.150 for HP-UX B.11.00, B.11.11, and B.11.23 allows remote attackers ...

CVE-2020-139099.8

The Ignition component before 2.0.5 for Laravel mishandles globals, _get, _post, _cookie, and _env. NOTE: in the 1.x series, versi...

CVE-2019-183949.8

A Server Side Request Forgery (SSRF) vulnerability in FaviconServlet.java in Ignite Realtime Openfire through 4.4.2 allows attacke...

CVE-2021-31299.8

Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code be...