Vulnerability · Published Jul 9, 2021 · Assigned by GitHub_M

CVE-2021-32752Files or Directories Accessible to External Parties in ether/logs

High 7.2

In plain English

A high-severity security flaw in logs from ethercreative. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 65% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.2High

Exploit odds (30 days)1.1%top 34.8% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Ether Logs is a package that allows one to check one's logs in the Craft 3 utilities section. A vulnerability was found in versions prior to 3.0.4 that allowed authenticated admin users to access any file on the server. The vulnerability has been fixed in version 3.0.4. As a workaround, one may disable the plugin if untrustworthy sources have admin access.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	ether/logs	3.0.4	GHSA-fp63-499m-hq6m

Affected products (as reported)

Vendor	Product	Versions
ethercreative	logs	< 3.0.4

Weakness: CWE-552 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/ethercreative/logs/security/advisories/GHSA-fp63-499m-hq6m x_refsource_CONFIRM
https://github.com/ethercreative/logs/releases/tag/3.0.4 x_refsource_MISC