-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from cookie decryption combined with unserialization. The EncryptCookies middleware's decryptCookie method called the encrypter with serialization enabled (via static::$serialize=true), making it vulnerable to PHP object injection attacks if the APP_KEY was exposed. The patch in 5.6.30 disabled serialization by default (static::$serialize=false), which addressed the CWE-502 vulnerability by removing unsafe deserialization of client-provided cookies.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| illuminate/cookie | composer | >= 5.5.0, < 5.6.30 | 5.6.30 |
PHPPHPOngoing coverage of React2Shell