PT-2024-40136 · Laravel · Laravel

Published 2024-05-15 · Updated 2024-05-15

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions: Laravel (affected versions not specified)

Description: The issue concerns a potential exploit of the Laravel Encrypter component. This exploit may cause the Encrypter to fail during decryption and unexpectedly return false. To exploit this, an attacker must be able to modify the encrypted payload before it is decrypted. Depending on the application's code, this could lead to unexpected behavior when combined with weak type comparisons.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-1240

Related Identifiers

GHSA-6WJW-QF87-FV5V

Affected Products

Laravel

References · 6

• https://osv.dev/vulnerability/GHSA-6wjw-qf87-fv5v · Vendor Advisory
• https://github.com/FriendsOfPHP/security-advisories/blob/master/illuminate/encryption/2018-03-30-1.yaml · Note
• https://github.com/illuminate/encryption/commit/51667a52bd7d135c6aa40a897656ffe9d3cd072d · Note
• https://github.com/illuminate/encryption/commit/c80b1da6a0412bd74bd56dc80f6126f561631b05 · Note
• https://github.com/illuminate/encryption · Note
• https://medium.com/@taylorotwell/laravel-security-release-5-6-15-and-5-5-40-56f1257933a0 · Note