Laravel is a web application framework. When using wildcard validation to validate a given file or image field (files.), a user-crafted malicious request could potentially bypass the validation rules. This vulnerability is fixed in 11.44.1 and 12.1.1.
An issue in Laravel Framework 8 through 11 might allow a remote attacker to discover database credentials in storage/logs/laravel.log. NOTE: this is disputed by multiple third parties because the owner of a Laravel Framework installation can choose to have debugging logs, but needs to set the access control appropriately for the type of data that may be logged.
A vulnerability was found in laravel 5.1 and classified as problematic. This issue affects some unknown processing. The manipulation leads to deserialization. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-206501 was assigned to this vulnerability.
A vulnerability, which was classified as critical, was found in Laravel 5.1. Affected is an unknown function. The manipulation leads to deserialization. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-206688.
The Laravel framework versions between 11.9.0 and 11.35.1 are susceptible to reflected cross-site scripting due to an improper encoding of request parameters in the debug-mode error page.
The Laravel framework versions between 11.9.0 and 11.35.1 are susceptible to reflected cross-site scripting due to an improper encoding of route parameters in the debug-mode error page.
A deserialization vulnerability in the destruct() function of Laravel v8.5.9 allows attackers to execute arbitrary commands.
Laravel v11.x was discovered to contain an XML External Entity (XXE) vulnerability.
End of life: 1/24/2023, End of support: 7/26/2022, Latest version: 8.83.29
End of life: 1/24/2023, End of support: 7/26/2022, Latest version: 8.83.29
Laravel before 5.5.10 mishandles the rememberme token verification process because DatabaseUserProvider does not have constant-time token comparison.
An issue was discovered in Laravel before 6.18.35 and 7.x before 7.24.0. The $guarded property is mishandled in some situations involving requests with JSON column nesting expressions.
An issue was discovered in Laravel before 6.18.34 and 7.x before 7.23.2. Unvalidated values are saved to the database component in some situations in which table names are stripped during a mass assignment.
Description
Laravel versions <6.20.12, <7.30.3 & <8.22.1 contain a query binding exploitation.
If a request is crafted where a field that is normally a non-array value is an array, and that input is not validated or cast to its expected type before being passed to the query builder, an unexpected number of query bindings can be added to the query. In some situations, this will simply lead to no results being returned by the query builder; however, it is possible certain queries could be affected in a way that causes the query to return unexpected results.
This vulnerability was discovered by Tim Groenevelt (tim.g@foodbyus.com).
References
- https://github.com/laravel/framework/pull/35865
End of life: 3/3/2021, End of support: 10/6/2020, Latest version: 7.30.7
End of life: 3/3/2021, End of support: 10/6/2020, Latest version: 7.30.7
End of life: 9/6/2022, End of support: 1/25/2022, Latest version: 6.20.45
End of life: 9/6/2022, End of support: 1/25/2022, Latest version: 6.20.45