CVE-2017-9303: Input Validation
Published May 7, 2017
·Updated
Laravel 5.4.x before 5.4.22 does not properly constrain the host portion of a password-reset URL, which makes it easier for remote attackers to conduct phishing attacks by specifying an attacker-controlled host.
Affected Software
8 affected componentsFixes available
composer/laravel/framework>=5.3.0, <=5.3.31, >=5.4.0, <5.4.22
composer/illuminate/auth>=5.3.0, <=5.3.31, >=5.4.0, <5.4.22
composer/laravel/framework>=5.4.0<5.4.22
5.4.22
composer/laravel/framework>=5.3.0<=5.3.31
composer/illuminate/auth>=5.4.0<5.4.22
5.4.22
composer/illuminate/auth>=5.3.0<=5.3.31
composer/laravel/laravel>=5.4.0<5.4.22
5.4.22
Laravel Laravel=5.4.0
Event History
May 7, 2017
Advisory Published
05:49 PM
May 29, 2017
CVE Published
via MITRE·10:00 PM
Data Sourced
via MITRE·10:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2017-9303?
CVE-2017-9303 is considered a medium severity vulnerability due to its potential for password reset phishing attacks.
2
How do I fix CVE-2017-9303?
To fix CVE-2017-9303, update your Laravel framework to version 5.4.22 or later.
3
Which versions are affected by CVE-2017-9303?
CVE-2017-9303 affects Laravel versions 5.4.0 through 5.4.21 and 5.3.0 through 5.3.31.
4
What type of attack does CVE-2017-9303 enable?
CVE-2017-9303 enables remote attackers to conduct phishing attacks by manipulating the host portion of password-reset URLs.
5
Is CVE-2017-9303 present in Laravel 5.4.22 or later?
No, CVE-2017-9303 is not present in Laravel 5.4.22 or later, as those versions contain the necessary security fix.