CVE-2021-3129 — Laravel Ignition File Upload Vulnerability
CVE-2021-3129: Laravel Ignition File Upload Vulnerability
CISA Known Exploited Vulnerability (KEV)
| Vendor / project | Laravel |
| Product | Ignition |
| Date added | 2023-09-18 |
| Due date | 2023-10-09 |
| Ransomware campaign use | Known |
Description
Laravel Ignition contains a file upload vulnerability that allows unauthenticated remote attackers to execute malicious code due to insecure usage of file_get_contents() and file_put_contents().
Required action (CISA)
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Notes
https://github.com/facade/ignition/releases/tag/2.5.2; https://nvd.nist.gov/vuln/detail/CVE-2021-3129
References
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2021-3129
- KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog