CVE-2019-17050

Published: Sep 30, 2019Modified: Jun 17, 2026

7.2

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.2 / Impact: 5.9

Source: NVD

Description

An issue was discovered in the Voyager package through 1.2.7 for Laravel. An attacker with admin privileges and Compass access can read or delete arbitrary files, such as the .env file. NOTE: a software maintainer has suggested a solution in which Compass is switched off in a production environment.

Affected (1)

Products: Thecontrolgroup: Voyager

Thecontrolgroup

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Thecontrolgroup Voyager	Up to 1.2.7

Related CWEs

Authorization Bypass Through User-Controlled Key

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

References (2)

https://github.com/the-control-group/voyager/issues/4322

Source: cve@mitre.org

Third Party Advisory

https://github.com/the-control-group/voyager/issues/4322

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.