CVE-2024-29291: Laravel Framework 11 - Credential Leakage
An issue in Laravel Framework 8 through 11 might allow a remote attacker to discover database credentials in storage/logs/laravel.log. NOTE: this is disputed by multiple third parties because the owner of a Laravel Framework installation can choose to have debugging logs, but needs to set the access control appropriately for the type of data that may be logged.
Credit
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-29291?
CVE-2024-29291 is considered a moderate severity vulnerability due to the potential for remote attackers to access sensitive database credentials.
How do I fix CVE-2024-29291?
To fix CVE-2024-29291, ensure that your Laravel version is upgraded to the latest release beyond version 11 and avoid enabling debugging logs in production.
Who is affected by CVE-2024-29291?
CVE-2024-29291 affects all users of Laravel Framework versions 8 through 11 who have debugging logs enabled.
Can CVE-2024-29291 be exploited remotely?
Yes, CVE-2024-29291 can be exploited remotely if the Laravel logs are improperly configured to be accessible.
What is the potential impact of CVE-2024-29291?
The potential impact of CVE-2024-29291 includes exposure of sensitive database credentials, which can lead to unauthorized access to the database.