Detections
Analytics

SCA: security update for filament/actions (GHSA-4hxw-gc2q-f6f3)

low Tenable Self-Hosted Container Security Plugin ID 410234

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Filament is a collection of full-stack components for accelerated Laravel development. All Filament
 features that interact with storage use the `default_filesystem_disk` config option. This allows the user
 to easily swap their storage driver to something production-ready like `s3` when deploying their app,
 without having to touch multiple configuration options and potentially forgetting about some. The default
 disk is set to `public` when you first install Filament, since this allows users to quickly get started
 developing with a functional disk that allows features such as file upload previews locally without the
 need to set up an S3 disk with temporary URL support. However, some features of Filament such as exports
 also rely on storage, and the files that are stored contain data that should often not be public. This is
 not an issue for the many deployed applications, since many use a secure default disk such as S3 in
 production. However, [CWE-1188](https://cwe.mitre.org/data/definitions/1188.html) suggests that having the
 `public` disk as the default disk in Filament is a security vulnerability itself. As such, we have
 implemented a measure to protect users whereby if the `public` disk is set as the default disk, the
 exports feature will automatically swap it out for the `local` disk, if that exists. Users who set the
 default disk to `local` or `s3` already are not affected. If a user wants to continue to use the `public`
 disk for exports, they can by setting the export disk deliberately. This change has been included in the
 3.2.123 release and all users who use the `public` disk are advised to upgrade. (CVE-2024-51758)

See Also

https://github.com/advisories/GHSA-4hxw-gc2q-f6f3

Plugin Details

Severity: Low

ID: 410234

Version: Revision 1.9

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 1.2

Percentile: 0.01

Vendor

Vendor Severity: Low

CVSS v2

Risk Factor: Low

Base Score: 3.3

Temporal Score: 2.4

Vector: CVSS2#AV:N/AC:L/Au:M/C:P/I:N/A:N

CVSS Score Source: CVE-2024-51758

CVSS v3

Risk Factor: Low

Base Score: 2.4

Temporal Score: 2.1

Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: Low

Base Score: 2.3

Threat Score: 0.6

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 11/7/2024

Vulnerability Publication Date: 11/7/2024

Reference Information

CVE: CVE-2024-51758