GitHub Advisoryadvisory · Packagist
GHSA-7fjp-g4m7-fx23 User (Encrypted) Password Field Being Serialised
LOW
Official page ↗
- Ecosystem
- Packagist
- Packages
- pwweb/laravel-core
- Severity
- Low
- Weaknesses
- CWE-200
- Reviewed
- 2021-04-12
Affected packages
• Packagist pwweb/laravel-core: < 0.3.7-beta → fixed in 0.3.7-beta
Description
Impact
Leaking Password field during serialisation of the User model. Password is in the encrypted form but if User model is requested in json or array form the value is printed.
Patches
Issue has been patched in version 0.3.7-beta and onwards.
Workarounds
Add the 'password' field to the Users model file in the hidden array:
```php
/**
• The attributes that should be hidden for arrays.
*
• @var array
*/
protected $hidden = [
'remember_token',
'password',
];
```
For more information
If you have any questions or comments about this advisory:
• Open an issue in pwweb/laravel-core
• Email us at [email protected]
Related
Weakness · CWE (1)
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness