Laravel Risk of mass-assignment vulnerabilities

published 2024-05-15 2y ago modified 2024-11-29 last yr.

cvss: —; not scored
cisa kev: Not listed; not in CISA's catalog
epss: —; no score, EPSS covers CVEs only
public exploits: 0; none known

Laravel 4.1.29 improves the column quoting for all database drivers. This protects your application from some mass assignment vulnerabilities when not using the fillable property on models. If you are using the fillable property on your models to protect against mass assignment, your application is not vulnerable. However, if you are using guarded and are passing a user controlled array into an "update" or "save" type function, you should upgrade to 4.1.29 immediately as your application may be at risk of mass assignment.

Patch / fix

fixed in 1

packagist illuminate/database 4.1.29

Is GHSA-cc2w-ghc5-m5qr in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem	package	affected	fixed in
packagist	illuminate/database	>=4.0.0, <4.1.29	4.1.29

Classification

Weakness

CWE-20 Improper Input Validation

References

Sources

GitHub Advisory GHSA-cc2w-ghc5-m5qr

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.