Description

The web application uses Laravel framework. Laravel LogViewer is enabled and accessible. In production environment, it leads to disclosure of sensitive information about the web application.

Remediation

Disable the LogViewer or restrict access to it

References

ARCANEDEV LogViewer

Related Vulnerabilities

WordPress Plugin Customize WordPress Emails and Alerts-Better Notifications for WP Information Disclosure (1.8.6)

Spring Boot Actuator

MediaWiki remote code execution

Phusion Passenger Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2018-12027)

SAP NetWeaver Java AS WD_CHAT information disclosure vulnerability

Severity

Medium

Classification

CWE-200 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Tags

Configuration Information Disclosure