CVE-2017-9303:
Laravel does not properly constrain the host portion of a password-reset URL
6.1
CVSS ScoreBasic Information
CVE ID
GHSA ID
EPSS Score
-
CWE
Published
5/17/2022
Updated
4/25/2024
KEV Status
No
Technology
PHP
PHPTechnical Details
CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| laravel/laravel | composer | >= 5.4.0, < 5.4.22 | 5.4.22 |
| illuminate/auth | composer | >= 5.3.0, <= 5.3.31 | |
| illuminate/auth | composer | >= 5.4.0, < 5.4.22 | 5.4.22 |
| laravel/framework | composer | >= 5.3.0, <= 5.3.31 | |
| laravel/framework | composer | >= 5.4.0, < 5.4.22 | 5.4.22 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability stems from password reset URLs being generated without host validation. The commit diff shows the critical change from route() to url(config('app.url').route(...)) in ResetPassword.php's toMail method. This indicates the original route() call was vulnerable to host injection. The function's role in constructing password reset links directly matches the vulnerability description of improper host constraint.