vulnwire
6.1med

CVE-2017-9303

Laravel does not properly constrain the host portion of a password-reset URL

Also known as GHSA-rc8x-jrrc-frfv

Published 9 y ago · modified 4 mo ago · JSON

CVSS
6.1
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
1.0%
percentile 62%
Public exploits
0
none known

Laravel 5.4.x before 5.4.22 does not properly constrain the host portion of a password-reset URL, which makes it easier for remote attackers to conduct phishing attacks by specifying an attacker-controlled host.

Exploit prediction (EPSS)

0.96% probability of exploitation in the next 30 days, higher than 62% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.06.1CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
NVD2.05.8AV:N/AC:M/Au:N/C:P/I:P/A:N
GitHub3.06.1CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected packages

EcosystemPackageAffectedFixed in
packagistlaravel/laravel
>=5.4.0, <5.4.22
5.4.22
packagistilluminate/auth
>=5.3.0, <=5.3.31
>=5.4.0, <5.4.22
5.4.22
packagistlaravel/framework
>=5.3.0, <=5.3.31
>=5.4.0, <5.4.22
5.4.22

Classification

Weakness
  • CWE-20 Improper Input Validation

References

  • laravel-news.com /laravel-5-4-22-is-now-released-and-includes-a-security-fix · x_refsource_CONFIRM, x_transferred
  • securityfocus.com /bid/98776 · vdb-entry, x_refsource_BID, x_transferred
  • nvd.nist.gov /vuln/detail/CVE-2017-9303 · advisory
  • github.com /laravel/framework/commit/cef10551820530632a86fa6f1306fee95c5cac43 · web
  • github.com /FriendsOfPHP/security-advisories/blob/master/illuminate/auth/CVE-2017-9303.yaml · web
  • github.com /FriendsOfPHP/security-advisories/blob/master/laravel/framework/CVE-2017-9303.yaml · web
  • laravel.com /docs/5.4/releases#laravel-5.4.22 · web
  • web.archive.org /web/20171021180417/http://www.securityfocus.com/bid/98776 · web

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.