GitHub Advisoryadvisory · Packagist

GHSA-gv7v-rgg6-548h Laravel environment manipulation via query string

HIGH Published 2024-11-12 Modified 2024-12-21 Official page ↗
Aliases
CVE-2024-52301
Ecosystem
Packagist
Packages
laravel/framework
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
Weaknesses
CWE-88
Reviewed
2024-11-12

Affected packages

• Packagist laravel/framework: < 6.20.45 → fixed in 6.20.45 • Packagist laravel/framework: >= 7.0.0, < 7.30.7 → fixed in 7.30.7 • Packagist laravel/framework: >= 8.0.0, < 8.83.28 → fixed in 8.83.28 • Packagist laravel/framework: >= 9.0.0, < 9.52.17 → fixed in 9.52.17 • Packagist laravel/framework: >= 10.0.0, < 10.48.23 → fixed in 10.48.23 • Packagist laravel/framework: >= 11.0.0, < 11.31.0 → fixed in 11.31.0

Description

Description When the `register_argc_argv php` directive is set to `on` , and users call any URL with a special crafted query string, they are able to change the environment used by the framework when handling the request. Resolution The framework now ignores argv values for environment detection on non-cli SAPIs.

Related

Alias · CVE (1)

  • CVE-2024-52301 Laravel is a web application framework. vulnerability

Weakness · CWE (1)

  • CWE-88 Improper Neutralization of Argument Delimiters in a Command weakness

References