CVE-2021-43996 Incorrect Access Control in Ignition
The Laravel Ignition component's variable name fixing feature can lead to incorrect access control, allowing unauthorized access.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-43996?
CVE-2021-43996 is a critical missing authorization vulnerability in n/a, published on 17 Nov 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Ignition component before 1.16.15, and 2.0.x before 2.0.6, for Laravel has a "fix variable names" feature that can lead to incorrect access control.
Which versions are affected by CVE-2021-43996?
4 open source packages ship an affected version, including facade/ignition. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
facade/ignition Packagist | All versions | 1.16.15 |
facade/ignition Packagist | All versions | 1.16.15 |
facade/ignition Packagist | From 2.0.0 | 2.0.6 |
facade/ignition Packagist | From 2.0.0 | 2.0.6 |
Products include Facade Ignition.
How do I fix CVE-2021-43996?
Upgrade facade/ignition to a fixed version for your release line: 1.16.15 or 2.0.6.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2021-43996 being exploited?
There is no known exploitation of CVE-2021-43996 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-vhrp-8qx4-vr6c.