« Volver al listado

CVE-2024-42485

Estado: AnalizadaAlta (7.5)—

Filament Excel enables excel export for Filament admin resources. The export download route `/filament-excel/{path}` allowed downloading any file without login when the webserver allows `../` in the URL. Patched with Version v2.3.3.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Pxlrbt — Filament Excel

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-42485",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-42485",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-08-12T16:27:48.318292Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "pxlrbt",
          "product": "filament-excel",
          "versions": [
            {
              "status": "affected",
              "version": ">= 2.0.0-alpha, < 2.3.3"
            },
            {
              "status": "affected",
              "version": "< 1.1.14"
            }
          ]
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:filament:excel_export:*:*:*:*:*:*:*:*"
          ],
          "vendor": "filament",
          "product": "excel_export",
          "versions": [
            {
              "status": "affected",
              "version": "2.0.0-alpha",
              "lessThan": "2.3.3",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "0",
              "lessThan": "1.1.14",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-08-12T16:15:16.453",
  "references": [
    {
      "url": "https://github.com/pxlrbt/filament-excel/commit/bda42891a4b0c15d5dab5da8c53a006ddadccfb7",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/pxlrbt/filament-excel/security/advisories/GHSA-m3px-vjxr-fx4m",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Filament Excel enables excel export for Filament admin resources. The export download route `/filament-excel/{path}` allowed downloading any file without login when the webserver allows `../` in the URL.  Patched with Version v2.3.3."
    },
    {
      "lang": "es",
      "value": "Filament Excel permite la exportación de Excel para los recursos de administración de Filament. La ruta de descarga de exportación `/filament-excel/{path}` permitía descargar cualquier archivo sin iniciar sesión cuando el servidor web permite `../` en la URL. Parcheado con la versión v2.3.3."
    }
  ],
  "lastModified": "2026-06-17T07:49:32.547",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:pxlrbt:filament_excel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8ADF6739-5F84-4773-8C2C-CF887B582D2C",
              "versionEndExcluding": "1.1.14",
              "versionStartIncluding": "1.0.0"
            },
            {
              "criteria": "cpe:2.3:a:pxlrbt:filament_excel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E372F63F-C21E-4F1B-A848-46F5DAFD31A4",
              "versionEndExcluding": "2.3.3",
              "versionStartIncluding": "2.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}