| Package | Affected versions | Patched versions |
|---|---|---|
| illuminate/auth | ≥ 5.3.0, ≤ 5.3.31≥ 5.4.0, < 5.4.22 | 5.4.22 |
| laravel/framework | ≥ 5.3.0, ≤ 5.3.31≥ 5.4.0, < 5.4.22 | 5.4.22 |
| laravel/laravel | ≥ 5.4.0, < 5.4.22 | 5.4.22 |
| laravel | = 5.4.0 |
Laravel 5.4.x before 5.4.22 does not properly constrain the host portion of a password-reset URL, which makes it easier for remote attackers to conduct phishing attacks by specifying an attacker-controlled host.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free