CVE-2024-52301:
Laravel environment manipulation via query string
8.7
CVSS Score
4.0
Basic Information
CVE ID
GHSA ID
EPSS Score
0.93203%
CWE
Published
11/12/2024
Updated
12/21/2024
KEV Status
No
Technology
PHP
PHPTechnical Details
CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| laravel/framework | composer | < 6.20.45 | 6.20.45 |
| laravel/framework | composer | >= 7.0.0, < 7.30.7 | 7.30.7 |
| laravel/framework | composer | >= 8.0.0, < 8.83.28 | 8.83.28 |
| laravel/framework | composer | >= 9.0.0, < 9.52.17 | 9.52.17 |
| laravel/framework | composer | >= 10.0.0, < 10.48.23 | 10.48.23 |
| laravel/framework | composer | >= 11.0.0, < 11.31.0 | 11.31.0 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability stems from environment detection using argv parameters in web contexts. The resolution explicitly states ignoring argv for non-CLI SAPIs. The DetectEnvironment class is responsible for environment detection in Laravel, and its detectEnvironment() method would be the logical place where argv parsing occurred before the patch. The confidence is high because the vulnerability description directly matches this component's functionality and the patched behavior aligns with this method's responsibility.