CVE-2024-52301

high-risk
Published 2024-11-12

Laravel is a web application framework. When the register_argc_argv php directive is set to on , and users call any URL with a special crafted query string, they are able to change the environment used by the framework when handling the request. The vulnerability fixed in 6.20.45, 7.30.7, 8.83.28, 9.52.17, 10.48.23, and 11.31.0. The framework now ignores argv values for environment detection on non-cli SAPIs.

Do I need to act?

!
65.7% chance of exploitation in next 30 days
EPSS score — higher than 34% of all CVEs
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.5/10 High
NETWORK / LOW complexity

Affected Products (2)

Affected Vendors

Debian Laravel

References (2)

Vendor Advisory https://github.com/laravel/framework/security/advisories/GHSA-gv7v-rgg6-548h
Mailing List https://lists.debian.org/debian-lts-announce/2024/12/msg00019.html
52
/ 100
high-risk
Severity 26/34 · High
Exploitability 19/34 · Moderate
Exposure 7/34 · Low