Homepage
About Snyk

Resource Management Errors Affecting laravel/framework package, versions <6.20.14 >=7.0.0, <7.30.4 >=8.0.0, <8.24.0

0.0
medium

Snyk CVSS

    Attack Complexity Low
    User Interaction Required
    Availability High

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-PHP-LARAVELFRAMEWORK-1069892
  • published 3 Feb 2021
  • disclosed 2 Feb 2021
  • credit Unknown
Report a new vulnerability Found a mistake?

Introduced: 2 Feb 2021

CVE NOT AVAILABLE CWE-399 Open this link in a new tab
CWE-915 Open this link in a new tab

How to fix?

Upgrade laravel/framework to version 6.20.14, 7.30.4, 8.24.0 or higher.

Overview

laravel/framework is a PHP framework for web artisans.

Affected versions of this package are vulnerable to Resource Management Errors. This is a follow-up a previous security advisory which addresses a few additional edge cases.

If a request is crafted where a field that is normally a non-array value is an array, and that input is not validated or cast to its expected type before being passed to the query builder, an unexpected number of query bindings can be added to the query. In some situations, this will simply lead to no results being returned by the query builder; however, it is possible certain queries could be affected in a way that causes the query to return unexpected results.