What is GHSA-vhrp-8qx4-vr6c?

GHSA-vhrp-8qx4-vr6c is a security advisory published by GitHub Security Advisories with Critical severity. Incorrect Access Control in Ignition

Which CVE IDs does GHSA-vhrp-8qx4-vr6c cover?

GHSA-vhrp-8qx4-vr6c covers the following CVE IDs: CVE-2021-43996. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-vhrp-8qx4-vr6c?

GHSA-vhrp-8qx4-vr6c has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-vhrp-8qx4-vr6c?

GHSA-vhrp-8qx4-vr6c affects 2 products, including: composer/facade/ignition:\u003c 1.16.15; composer/facade/ignition:\u003e= 2.0.0, \u003c 2.0.6.

GHSA-vhrp-8qx4-vr6cCriticalCVSS 9.8

Incorrect Access Control in Ignition

Vendor

GitHub Security Advisories

Published

November 19, 2021

Last Modified

August 17, 2023

🔗 CVE IDs covered (1)

CVE-2021-43996 →

📋 Description

The Ignition component before 1.16.15, and 2.0.x before 2.0.6, for Laravel has a "fix variable names" feature that can lead to incorrect access control.

🎯 Affected products2

composer/facade/ignition:< 1.16.15
composer/facade/ignition:>= 2.0.0, < 2.0.6

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2021-43996
https://github.com/facade/ignition/pull/285
https://github.com/facade/ignition/compare/1.16.14...1.16.15
https://github.com/facade/ignition/compare/2.0.5...2.0.6
https://github.com/advisories/GHSA-vhrp-8qx4-vr6c