{"id":"CVE-2020-13909","published":"2020-06-07T19:26:47Z","modified":"2024-08-04T12:32:14Z","title":"The Ignition component before 2.0.5 for Laravel mishandles globals, _get, _post, _cookie, and _env","vendor":null,"product":null,"tier":"tail","description":{"text":"The Ignition component before 2.0.5 for Laravel mishandles globals, _get, _post, _cookie, and _env. NOTE: in the 1.x series, versions 1.16.15 and later are unaffected as a consequence of the CVE-2021-43996 fix.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.01516,"percentile":0.74424,"provenance":"source"},"cwes":[],"references":[{"url":"https://github.com/facade/ignition/releases/tag/2.0.5","tags":["x_refsource_MISC"]},{"url":"https://github.com/facade/ignition/compare/2.0.4...2.0.5","tags":["x_refsource_MISC"]}],"priority":{"score":14.9,"factors":[{"name":"EPSS percentile","points":14.88}]},"affected":[{"ecosystem":"Packagist","package":"facade/ignition","vulnerableRanges":[">=2.0.0, <2.0.5","<1.16.15"],"patched":["2.0.5","1.16.15"],"from":["GHSA-m5v7-pr32-mjx2"],"provenance":"source"}],"euvd":{"id":"EUVD-2021-2223","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2020-13909","published":"2020-06-07","fixed":"2.0.5","kev":false},{"cve":"CVE-2021-43996","published":"2021-11-17","fixed":"2.0.6","kev":false,"link":{"from":"CVE-2020-13909","to":"CVE-2021-43996","relation":"successor","confidence":"medium","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:facade/ignition","fromFixed":"2.0.5","toFixed":"2.0.6","daysApart":528},{"kind":"similar","provenance":"machine","score":0.39,"basis":"same package + description similarity"}]}},{"cve":"CVE-2021-3129","published":"2021-01-12","fixed":"2.5.2","kev":true}],"package":"Packagist:facade/ignition"}}