high7.2
CVE-2021-32752
Files or Directories Accessible to External Parties in ether/logs
Impact
### Impact A vulnerability was found that allowed authenticated admin users to access any file on the server. ### Patches The vulnerability has been fixed in 3.0.4. ### Workarounds We recommend disabling the plugin if untrustworthy sources have admin access. ### For more information If you have any questions or comments about this advisory: * Open an issue in [ether/logs](https://github.com/ethercreative/logs/issues)
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | ether/logs | < 3.0.4 | 3.0.4 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Ethercreative | Logs | before 3.0.4 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/ethercreative/logs/releases/tag/3.0.4
- https://github.com/ethercreative/logs/security/advisories/GHSA-fp63-499m-hq6m
- https://github.com/advisories/GHSA-fp63-499m-hq6m
- https://github.com/ethercreative/logs/commit/eb225cc78b1123a10ce2784790f232d71c2066c4
- https://nvd.nist.gov/vuln/detail/CVE-2021-32752