Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:composer/laravel/framework@5.6.0
Typecomposer
Namespacelaravel
Nameframework
Version5.6.0
Qualifiers
Subpath
Is_vulnerabletrue
Next_non_vulnerable_version4.1.26
Latest_non_vulnerable_version9.32.0
Affected_by_vulnerabilities
0
url VCID-1apm-fx9d-3ufe
vulnerability_id VCID-1apm-fx9d-3ufe
summary 
Laravel Framework RCE Vulnerability
In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unserialize call on a potentially untrusted X-XSRF-TOKEN value. This involves the decrypt method in `Illuminate/Encryption/Encrypter.php` and PendingBroadcast in `gadgetchains/Laravel/RCE/3/chain.php` in phpggc. The attacker must know the application key, which normally would never occur, but could happen if the attacker previously had privileged access or successfully accomplished a previous attack.
references
0
reference_url https://github.com/kozmic/laravel-poc-CVE-2018-15133
reference_id
reference_type
scores
url https://github.com/kozmic/laravel-poc-CVE-2018-15133
1
reference_url https://github.com/laravel/framework
reference_id
reference_type
scores
url https://github.com/laravel/framework
2
reference_url https://github.com/laravel/framework/commit/d84cf988ed5d4661a4bf1fdcb08f5073835083a0
reference_id
reference_type
scores
url https://github.com/laravel/framework/commit/d84cf988ed5d4661a4bf1fdcb08f5073835083a0
3
reference_url https://laravel.com/docs/5.6/upgrade#upgrade-5.6.30
reference_id
reference_type
scores
url https://laravel.com/docs/5.6/upgrade#upgrade-5.6.30
4
reference_url https://nvd.nist.gov/vuln/detail/CVE-2018-15133
reference_id CVE-2018-15133
reference_type
scores
url https://nvd.nist.gov/vuln/detail/CVE-2018-15133
5
reference_url https://github.com/advisories/GHSA-qvqm-h22r-4cp9
reference_id GHSA-qvqm-h22r-4cp9
reference_type
scores
url https://github.com/advisories/GHSA-qvqm-h22r-4cp9
fixed_packages
0
url pkg:composer/laravel/framework@5.6.30
purl pkg:composer/laravel/framework@5.6.30
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/laravel/framework@5.6.30
aliases CVE-2018-15133, GHSA-qvqm-h22r-4cp9
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-1apm-fx9d-3ufe
1
url VCID-aju9-h338-mfhf
vulnerability_id VCID-aju9-h338-mfhf
summary 
Cryptographic Issues
Exploit of encryption failure vulnerability
references
0
reference_url https://medium.com/@taylorotwell/laravel-security-release-5-6-15-and-5-5-40-56f1257933a0
reference_id
reference_type
scores
url https://medium.com/@taylorotwell/laravel-security-release-5-6-15-and-5-5-40-56f1257933a0
fixed_packages
0
url pkg:composer/laravel/framework@5.6.15
purl pkg:composer/laravel/framework@5.6.15
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/laravel/framework@5.6.15
aliases GMS-2018-72
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-aju9-h338-mfhf
2
url VCID-c1e9-2tyr-j3e9
vulnerability_id VCID-c1e9-2tyr-j3e9
summary 
Session Fixation
Cookie serialization vulnerability in laravel framework.
references
0
reference_url https://laravel.com/docs/5.6/upgrade#upgrade-5.6.30
reference_id
reference_type
scores
url https://laravel.com/docs/5.6/upgrade#upgrade-5.6.30
fixed_packages
0
url pkg:composer/laravel/framework@5.6.30
purl pkg:composer/laravel/framework@5.6.30
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/laravel/framework@5.6.30
aliases GMS-2018-73
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-c1e9-2tyr-j3e9
Fixing_vulnerabilities
Risk_scorenull
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:composer/laravel/framework@5.6.0