GitHub Advisoryadvisory · Packagist

GHSA-rc8x-jrrc-frfv Laravel does not properly constrain the host portion of a password-reset URL

MEDIUM Published 2022-05-17 Modified 2024-04-25 Official page ↗
Aliases
CVE-2017-9303
Ecosystem
Packagist
Packages
laravel/laravel, illuminate/auth, laravel/framework
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-20
Reviewed
2024-04-25

Affected packages

• Packagist laravel/laravel: >= 5.4.0, < 5.4.22 → fixed in 5.4.22 • Packagist illuminate/auth: >= 5.3.0, <= 5.3.31 (no fix yet) • Packagist illuminate/auth: >= 5.4.0, < 5.4.22 → fixed in 5.4.22 • Packagist laravel/framework: >= 5.3.0, <= 5.3.31 (no fix yet) • Packagist laravel/framework: >= 5.4.0, < 5.4.22 → fixed in 5.4.22

Description

Laravel 5.4.x before 5.4.22 does not properly constrain the host portion of a password-reset URL, which makes it easier for remote attackers to conduct phishing attacks by specifying an attacker-controlled host.

Related

Alias · CVE (1)

  • CVE-2017-9303 Laravel 5.4.x before 5.4.22 does not properly constrain the host portion of a password-reset URL, which makes it easier for remote… vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References