laravel Vulnerabilities and Affected Products
Vulnerabilities associated with Laravel Framework.
Products
Clear product- framework5 vulnerabilities
- Laravel Framework4 vulnerabilities
- livewire3 vulnerabilities
- reverb2 vulnerabilities
- Ignition1 vulnerability
- Laravel Valet1 vulnerability
- passport1 vulnerability
- pulse1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2024-52301HIGH | Laravel allows environment manipulation via query stringLaravel is a web application framework. When the register_argc_argv php directive is set to on , and users call any URL with a special crafted query string, they are able to change the environment used by the framework when handling the request. The vulnerability fixed in 6.20.45, 7.30.7, 8.83.28, 9.52.17, 10.48.23, and 11.31.0. The framework now ignores argv values for environment detection on non-cli SAPIs. CWE-88Nov 12, 2024 | CVSS8.7v4.0 | EPSS44% | PoCs3 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
Laravel Laravel Framework Exposure of Sensitive Information to an Unauthorized ActorAn issue in Laravel Framework 8 through 11 might allow a remote attacker to discover database credentials in storage/logs/laravel.log. NOTE: this is disputed by multiple third parties because the owner of a Laravel Framework installation can choose to have debugging logs, but needs to set the access control appropriately for the type of data that may be logged. CWE-200Apr 16, 2024 | CVSS- | EPSS1.34% | PoCs1 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
CVE-2018-15133HIGH | Laravel Framework RCE VulnerabilityIn Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unserialize call on a potentially untrusted X-XSRF-TOKEN value. This involves the decrypt method in Illuminate/Encryption/Encrypter.php and PendingBroadcast in gadgetchains/Laravel/RCE/3/chain.php in phpggc. The attacker must know the application key, which normally would never occur, but could happen if the attacker previously had privileged access or successfully accomplished a pre… CWE-502Aug 9, 2018 | CVSS8.1v3.1 | EPSS76.8% | PoCs13 | SignalsListed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2017-16894HIGH | Laravel Laravel Framework Exposure of Sensitive Information to an Unauthorized ActorIn Laravel framework through 5.5.21, remote attackers can obtain sensitive information (such as externally usable passwords) via a direct request for the /.env URI. NOTE: this CVE is only about Laravel framework's writeNewEnvironmentFileWith function in src/Illuminate/Foundation/Console/KeyGenerateCommand.php, which uses file_put_contents without restricting the .env permissions. The .env filename is not used exclusively by Laravel framework. | CVSS7.5v3.0 | EPSS87% | PoCs2 | SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei template | STIX |