GitHub Advisoryadvisory · Packagist
GHSA-qwvp-268g-jjm8 Data Leakage Vulnerability in livewire/livewire
MEDIUM
Official page ↗
- Ecosystem
- Packagist
- Packages
- livewire/livewire
- Severity
- Moderate
- Weaknesses
- CWE-200
- Reviewed
- 2024-05-15
Affected packages
• Packagist livewire/livewire: >= 2.2.5, < 2.2.6 → fixed in 2.2.6
Description
livewire/livewire versions greater than 2.2.4 and less than 2.2.6 are affected by a data leakage vulnerability. The `$this->validate()` method, which is expected to return only the validated dataset, was returning all properties of the Livewire component. This regression introduced a security risk, allowing unvalidated data to be exposed, which could lead to unexpected behavior and potential security issues.
Related
Weakness · CWE (1)
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness