Vulnerability advisory

BIT-laravel-2020-24940

Published Mar 6, 2024Updated Apr 3, 2025OSV record ↗

Also known as CVE-2020-24940GHSA-c7rm-w2hj-x8g3

Severity

Severity not reported.

Affected versions

laravel Bitnami

Affected Fixed in

All versions before 6.18.34 6.18.34

7.0.0 to before 7.23.2 7.23.2

Affected	Fixed in
All versions before 6.18.34	`6.18.34`
`7.0.0` to before 7.23.2	`7.23.2`
Severity for this package CVSS 3.x`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N`

Severity for this package

CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Description

An issue was discovered in Laravel before 6.18.34 and 7.x before 7.23.2. Unvalidated values are saved to the database in some situations in which table names are stripped during a mass assignment.

References

Webblog.laravel.com/security-release-laravel-61834-7232 ↗
Webnvd.nist.gov/vuln/detail/CVE-2020-24940 ↗