CyberSec.Space Logo
Back to CVE Browser

CVE-2020-13909

CRITICAL
9.8
CVSS Severity Score
EPSS Score0.1230%
EPSS Percentile39.92th
PublishedJun 7, 2020
Last ModifiedNov 21, 2024

Vulnerability Description

The Ignition component before 2.0.5 for Laravel mishandles globals, _get, _post, _cookie, and _env. NOTE: in the 1.x series, versions 1.16.15 and later are unaffected as a consequence of the CVE-2021-43996 fix.

Affected Platforms (CPE)

📦
Facade

Ignition

>= 1.0.0 and < 1.16.15
📦
Facade

Ignition

>= 2.0.0 and < 2.0.5

References & Advisories

🔗 https://github.com/facade/ignition/compare/2.0.4...2.0.5
🔗 https://github.com/facade/ignition/releases/tag/2.0.5
🔗 https://github.com/facade/ignition/compare/2.0.4...2.0.5
🔗 https://github.com/facade/ignition/releases/tag/2.0.5

Related Vulnerabilities

CVE-2006-515110.0

Unspecified vulnerability in HP Ignite-UX server before C.6.9.150 for HP-UX B.11.00, B.11.11, and B.11.23 allows remote attackers ...

CVE-2021-31299.8

Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code be...

CVE-2019-183949.8

A Server Side Request Forgery (SSRF) vulnerability in FaviconServlet.java in Ignite Realtime Openfire through 4.4.2 allows attacke...

CVE-2021-439969.8

The Ignition component before 1.16.15, and 2.0.x before 2.0.6, for Laravel has a "fix variable names" feature that can lead to inc...