| Package | Affected versions | Patched versions |
|---|---|---|
| laravel/framework | ≥ 10.0.0, < 10.48.23≥ 11.0.0, < 11.31.0≥ 7.0.0, < 7.30.7≥ 8.0.0, < 8.83.28≥ 9.0.0, < 9.52.17< 6.20.45 | 10.48.2311.31.07.30.78.83.289.52.176.20.45 |
| framework | ≥ 10.0.0, < 10.48.23≥ 11.0.0, < 11.31.0≥ 7.0.0, < 7.30.7≥ 8.0.0, < 8.83.28≥ 9.0.0, < 9.52.17< 6.20.45 | 10.48.2311.31.07.30.78.83.289.52.176.20.45 |
When the register_argc_argv php directive is set to on , and users call any URL with a special crafted query string, they are able to change the environment used by the framework when handling the request.
The framework now ignores argv values for environment detection on non-cli SAPIs.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free