PT-2020-15863 · Taylor Otwell · Laravel

Published 2020-09-04 · Updated 2024-03-06 · CVE-2020-24940

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Laravel versions prior to 6.18.34 Laravel versions 7.x prior to 7.23.2

Description An issue allows unvalidated values to be saved to the database in certain situations where table names are stripped during mass assignment.

Recommendations For Laravel versions prior to 6.18.34, update to version 6.18.34 or later. For Laravel versions 7.x prior to 7.23.2, update to version 7.23.2 or later.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BIT-LARAVEL-2020-24940

CVE-2020-24940

GHSA-C7RM-W2HJ-X8G3

Affected Products

Laravel

References · 7

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/illuminate/database/CVE-2020-24940.yaml · Exploit
• https://osv.dev/vulnerability/CVE-2020-24940 · Vendor Advisory
• https://blog.laravel.com/security-release-laravel-61834-7232 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-laravel-2020-24940 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-c7rm-w2hj-x8g3 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-24940 · Security Note
• https://github.com/illuminate/database · Note