PT-2024-40241 · Laravel · Laravel

Published 2024-05-15 · Updated 2024-05-15

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions: Laravel versions prior to 4.1.29

Description: The issue concerns mass assignment vulnerabilities in Laravel when not using the fillable property on models or when using guarded and passing user-controlled arrays into update or save functions. This could put applications at risk if they are using versions prior to the fix.

Recommendations: For versions prior to 4.1.29, upgrade to 4.1.29 immediately to protect against mass assignment vulnerabilities. As a temporary workaround, consider restricting the use of guarded properties when passing user-controlled arrays into update or save functions until the upgrade is applied.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

GHSA-CC2W-GHC5-M5QR

Affected Products

Laravel

References · 4

• https://osv.dev/vulnerability/GHSA-cc2w-ghc5-m5qr · Vendor Advisory
• https://github.com/illuminate/database · Note
• https://github.com/FriendsOfPHP/security-advisories/blob/master/illuminate/database/2014-05-20.yaml · Note
• https://laravel.com/docs/5.1/upgrade#upgrade-4.1.29 · Note