CVE-2024-42485
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Summary
Filament Excel enables excel export for Filament admin resources. The export download route /filament-excel/{path} allowed downloading any file without login when the webserver allows ../ in the URL. Patched with Version v2.3.3.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| pxlrbt | filament-excel | >= 2.0.0-alpha, < 2.3.3 | affected |
| pxlrbt | filament-excel | < 1.1.14 | affected |
Weaknesses
- CWE-22: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
ADP Enrichment
CISA ADP Vulnrichment
- SSVC:
- Exploitation: none
- Automatable: yes
- Technical Impact: partial
References
- https://github.com/pxlrbt/filament-excel/security/advisories/GHSA-m3px-vjxr-fx4m
- https://github.com/pxlrbt/filament-excel/commit/bda42891a4b0c15d5dab5da8c53a006ddadccfb7
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.