PT-2024-40356 · Unknown · Laravel Framework

Published 2024-05-15 · Updated 2024-05-15

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Laravel Framework (affected versions not specified)

Description The issue arises when a field, normally a non-array value, is crafted as an array in a request and this input is not validated or cast to its expected type before being passed to the query builder. This can lead to an unexpected number of query bindings being added to the query, potentially causing the query to return unexpected results. In some cases, it may simply result in no results being returned by the query builder.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

GHSA-JWVJ-PWWW-3MJ5

Affected Products

Laravel Framework

References · 4

• https://osv.dev/vulnerability/GHSA-jwvj-pwww-3mj5 · Vendor Advisory
• https://github.com/laravel/framework · Note
• https://github.com/laravel/framework/security/advisories/GHSA-x7p5-p2c9-phvg · Note
• https://github.com/FriendsOfPHP/security-advisories/blob/master/laravel/framework/2021-01-21.yaml · Note