Vulnerability · Published Feb 27, 2023 · Assigned by mitre
CVE-2023-24249
High 7.2
In plain English
A high-severity security flaw in the encore/laravel-admin package (Packagist). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.4% (higher than 84% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Severity (CVSS NVD)7.2High
Exploit odds (30 days)2.4%top 15.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC
Official description
An arbitrary file upload vulnerability in laravel-admin v1.8.19 allows attackers to execute arbitrary code via a crafted PHP file.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | encore/laravel-admin | no fix listed | GHSA-g857-47pm-3r32 |