PT-2024-40457 · Laravel · Laravel

Published 2024-05-15 · Updated 2024-05-15

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Laravel versions prior to 4.1.29

Description The issue concerns mass assignment vulnerabilities in Laravel when not using the fillable property on models or when using guarded and passing user-controlled arrays into update or save functions. This could put applications at risk if they are using versions prior to the fix.

Recommendations For versions prior to 4.1.29, upgrade to 4.1.29 immediately to protect against mass assignment vulnerabilities. As a temporary workaround, consider restricting the use of guarded and ensure that user-controlled arrays are not passed into update or save type functions until the upgrade is applied.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

GHSA-RJ3W-99GC-8J58

Affected Products

Laravel

References · 5

• https://osv.dev/vulnerability/GHSA-rj3w-99gc-8j58 · Vendor Advisory
• https://github.com/laravel/framework · Note
• https://github.com/laravel/framework/commit/c942a1bc30999e3d7a5567f264bfc99c77843919 · Note
• https://github.com/FriendsOfPHP/security-advisories/blob/master/laravel/framework/2014-05-20.yaml · Note
• https://laravel.com/docs/5.3/upgrade#upgrade-4.1.29 · Note