CVE-2019-17050

published 2019-09-30

CVE-2019-17050: An issue was discovered in the Voyager package through 1.2.7 for Laravel. An attacker with admin privileges and Compass access can read or delete arbitrary…

Priority P2 75 high 7.2 CVSS 3.1

AV N AC L PR H UI N S U C H I H A H

ITW VulnCheck KEV

An issue was discovered in the Voyager package through 1.2.7 for Laravel. An attacker with admin privileges and Compass access can read or delete arbitrary files, such as the .env file. NOTE: a software maintainer has suggested a solution in which Compass is switched off in a production environment.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
thecontrolgroup	voyager	<= 1.2.7	—

Detection & IOCs extracted from sources · hover to see the quote

path .env↗

• → Monitor for ENV Crawler activity (reclassified as malicious by GreyNoise) targeting .env file paths, particularly in Laravel/Voyager deployments. ↗
• → GreyNoise reclassified over 11,000 IPs as malicious under the 'ENV Crawler' tag; use this tag to block opportunistic .env file harvesters that may exploit CVE-2019-17050. ↗

• · The vulnerability is only exploitable by an authenticated attacker with admin privileges and Compass access; unauthenticated exploitation is not indicated. ↗
• · The software maintainer recommends disabling Compass in production environments as a mitigation, which would eliminate the attack surface for this CVE. ↗

CVSS provenance

nvd v3.1 7.2 HIGH CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 6.5 MEDIUM AV:N/AC:L/Au:S/C:P/I:P/A:P

vulncheck 7.2 HIGH

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-639