facade/ignition

facade/ignition

Releases145

Frequency1 week 1 day

Last Releaseover 3 years ago

Stars2.08K

A beautiful error page for Laravel apps

Log in to subscribe

CVE History

CVE	Affected	Published	CVSS v3	CVSS v2
CVE-2021-43996NVD↗	< 1.6.15, >= 2.0.0, < 2.0.6, < 1.16.15	Nov 17, 2021Wednesday, 17 November 2021, 20:15	9.8 CRITICAL	7.5 HIGH
The Ignition component before 1.16.15, and 2.0.x before 2.0.6, for Laravel has a "fix variable names" feature that can lead to incorrect access control.
CVE-2021-3129NVD↗	< 2.5.2, >= 2.5.0, < 2.5.2, >= 2.0.0, < 2.4.2, >= 1.7.0, < 1.16.14, < 1.6.15	Jan 12, 2021Tuesday, 12 January 2021, 15:15	9.8 CRITICAL	7.5 HIGH
Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of file_get_contents() and file_put_contents(). This is exploitable on sites using debug mode with Laravel before 8.4.2.
CVE-2020-13909NVD↗	>= 1.0.0, < 1.16.15, >= 2.0.0, < 2.0.5, < 1.16.15	Jun 7, 2020Sunday, 7 June 2020, 20:15	9.8 CRITICAL	7.5 HIGH
The Ignition component before 2.0.5 for Laravel mishandles globals, _get, _post, _cookie, and _env. NOTE: in the 1.x series, versions 1.16.15 and later are unaffected as a consequence of the CVE-2021-43996 fix.