Description

The web application uses Laravel framework. Laravel LogViewer is enabled and accessible. In production environment, it leads to disclosure of sensitive information about the web application.

Remediation

Disable the LogViewer or restrict access to it

References

ARCANEDEV LogViewer

Related Vulnerabilities

TYPO3 Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2011-4627)

Mojolicious weak secret key

WordPress Plugin File Manager Information Disclosure (6.4)

WordPress Plugin Customize WordPress Emails and Alerts-Better Notifications for WP Information Disclosure (1.8.6)

Unrestricted access to Caddy API interface

Severity

Medium

Classification

CWE-200 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Tags

Configuration Information Disclosure