-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from insufficient IV validation in the validPayload method. The pre-patch implementation only checked for the existence of IV/value/mac fields but didn't verify the IV length matches the cipher's requirements (via openssl_cipher_iv_length). This allowed attackers to craft payloads with invalid IV lengths that would pass initial validation but fail during actual decryption, returning false. The commit 28e53f2 specifically adds the IV length check to this function, confirming it as the vulnerable point. The function's role in payload validation makes it the critical component enabling this cryptographic weakness (CWE-1240).
PHPPHP| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| laravel/framework | composer | < 5.5.40 | 5.5.40 |
| laravel/framework | composer | >= 5.6.0, < 5.6.15 | 5.6.15 |
Ongoing coverage of React2Shell