CVE-2017-16894

In Laravel framework through 5.5.21, remote attackers can obtain sensitive information (such as externally usable passwords) via a direct request for the /.env…

published November 20, 2017

Patch now

High probability of exploitation

NVD has not assigned a CVSS score to this record. It sits in the 99.7th percentile for exploit probability.

CVSS
—
EPSS
87%
Percentile
99.7
In the wild
Unconfirmed
What it is

In Laravel framework through 5.5.21, remote attackers can obtain sensitive information (such as externally usable passwords) via a direct request for the /.env URI. NOTE: this CVE is only about Laravel framework's writeNewEnvironmentFileWith function in src/Illuminate/Foundation/Console/KeyGenerateCommand.php, which uses file_put_contents without restricting the .env permissions. The .env filename is not used exclusively by Laravel framework.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.86916 · 99.7th percentile
Published
2017-11-20T01:00Z
EPSS history
Timeline
  • 20 NOV 01:00Z
    In Laravel framework through 5.5.21, remote attackers can obtain sensitive information (such as externally usable passwords) via a direct request for the /.env…
    cvelistv5