GitHub Advisoryadvisory · Packagist

GHSA-qwvp-268g-jjm8 Data Leakage Vulnerability in livewire/livewire

MEDIUM Published 2024-05-15 Modified 2024-05-15 Official page ↗
Ecosystem
Packagist
Packages
livewire/livewire
Severity
Moderate
Weaknesses
CWE-200
Reviewed
2024-05-15

Affected packages

• Packagist livewire/livewire: >= 2.2.5, < 2.2.6 → fixed in 2.2.6

Description

livewire/livewire versions greater than 2.2.4 and less than 2.2.6 are affected by a data leakage vulnerability. The `$this->validate()` method, which is expected to return only the validated dataset, was returning all properties of the Livewire component. This regression introduced a security risk, allowing unvalidated data to be exposed, which could lead to unexpected behavior and potential security issues.

Related

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References