PT-2024-40442 · Unknown · Livewire/Livewire

Published 2024-05-15 · Updated 2024-05-15

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions livewire/livewire versions 2.2.5

Description The issue is related to a data leakage problem. The $this->validate() method was returning all properties of the Livewire component, instead of only the validated dataset. This introduced a security risk, allowing unvalidated data to be exposed, which could lead to unexpected behavior and potential security issues.

Recommendations For version 2.2.5, update to a version that fixes the regression in the $this->validate() method to prevent unvalidated data exposure.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

GHSA-QWVP-268G-JJM8

Affected Products

Livewire/Livewire

References · 5

• https://osv.dev/vulnerability/GHSA-qwvp-268g-jjm8 · Vendor Advisory
• https://github.com/livewire/livewire · Note
• https://github.com/livewire/livewire/commit/6929f5882138a98187c196ce66cc689712c000af · Note
• https://github.com/livewire/livewire/releases/tag/v2.2.6 · Note
• https://github.com/FriendsOfPHP/security-advisories/blob/master/livewire/livewire/2020-09-22-1.yaml · Note