-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PHPPHP| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| illuminate/encryption | composer | >= 5.5.0, < 5.5.40 | 5.5.40 |
| illuminate/encryption | composer | >= 5.6.0, < 5.6.15 | 5.6.15 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from insufficient IV validation in the validPayload method. The patch added a critical check for IV length compatibility with the cipher algorithm. Prior versions would accept any IV that was base64 decodable, regardless of its actual length after decoding. This weakness in cryptographic validation (CWE-1240) made decryption susceptible to manipulated payloads, particularly when applications used loose comparisons (==) with the decryption result.
Ongoing coverage of React2Shell