8.1Hoch KEV

CVE-2018-15133Laravel Deserialization of Untrusted Data Vulnerability

laravel laravel Veröffentlicht: 2018-08-09 22:00 (vor 8 Jahren)

Bekannt ausgenutzt — Laravel Deserialization of Untrusted Data Vulnerability

CISA hat am 16.01.2024 bestätigt, dass diese Schwachstelle in echten Angriffen genutzt wird. Frist für US-Bundesbehörden: 06.02.2024.

Erforderliche Maßnahme: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. https://laravel.com/docs/5.6/upgrade#upgrade-5.6.30; https://nvd.nist.gov/vuln/detail/CVE-2018-15133

Beschreibung

In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unserialize call on a potentially untrusted X-XSRF-TOKEN value. This involves the decrypt method in Illuminate/Encryption/Encrypter.php and PendingBroadcast in gadgetchains/Laravel/RCE/3/chain.php in phpggc. The attacker must know the application key, which normally would never occur, but could happen if the attacker previously had privileged access or successfully accomplished a previous attack.

Schwachstellentyp (CWE): CWE-502

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Hersteller	Produkt	Versionen
laravel	laravel	≤ 5.5.40

Referenzen und Patches

https://laravel.com/docs/5.6/upgrade#upgrade-5.6.30 Vendor Advisory
http://packetstormsecurity.com/files/153641/PHP-Laravel-Framework-Token-Unserialize-Remote-Command-Execution.html ExploitThird Party AdvisoryVDB Entry
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-15133 US Government Resource

CPE-Treffer (NVD) (2)

cpe:2.3:a:laravel:laravel:*:*:*:*:*:*:*:* ≤ 5.5.40
cpe:2.3:a:laravel:laravel:*:*:*:*:*:*:*:* ≥ 5.6.0 ≤ 5.6.29

CVSS-Score

8.1Hoch

Quelle: CISA-ADP · CVSS 3.1

Angriffsvektor: Netzwerk
Komplexität: Hoch
Rechte erforderlich: Keine
Benutzerinteraktion: Keine
Geltungsbereich: Unverändert
Vertraulichkeit: Hoch
Integrität: Hoch
Verfügbarkeit: Hoch

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Alle Scores (4)

CISA-ADP	CVSS 3.1	8.1Hoch
nvd	CVSS 3.1	8.1Hoch
134c704f-9b21-4f2e-91b3-4a467353bcc0	CVSS 3.1	8.1Hoch
nvd	CVSS 2.0	6.8Mittel

EPSS (Ausnutzungswahrscheinlichkeit in 30 Tagen)

76.57%

höher als 100 % aller CVEs

CISA-Bewertung (SSVC)

Ausnutzung: active
Automatisierbar: no
Technische Auswirkung: total

Zeitverlauf

ID reserviert2018-08-07
Veröffentlicht2018-08-09 22:00
Bei IP-DB eingegangen2026-10-24 23:31
In KEV aufgenommen2024-01-16
Zuletzt aktualisiert2026-06-17 04:42

Vergeben von (CNA): mitre
NVD-Status: Analyzed

In der Quelle ansehen: CVE.org · NVD

Benachrichtigung bei neuen Schwachstellen in diesen Produkten

E-Mail-Warnungen aktivieren

Kostenlos · mit Konto · jederzeit abbestellbar

Neue CVEs im selben Produkt — Laravel

9.2Kritisch

CVE-2026-114509 vor 13 Tagen

Laravel TokenGuard authentication bypass through non-string API credentials

laravel framework

Laravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard configured as a standard token-based API guard does not reject a crafted non-string credential. Under affected MySQL or MariaDB configurations, the authentication lookup can matc…

6.5Mittel

CVE-2026-114508 vor 13 Tagen

Laravel relationship inclusion can trigger unauthorized data destruction

laravel framework

Laravel is a web application framework. From 12.45.0 until 12.68.0 and 13.27.0, crafted relationship inclusion on a read-only endpoint can trigger a destructive database operation on a related table instead of retrieving data. A user with read access but no w…

3.1Niedrig

CVE-2026-102279 vor 1 Monat

Laravel: XSS in Debug Page Information

laravel framework

Laravel is a web application framework. Prior to 12.69.0 and 13.30.0, Laravel exception debug pages with APP_DEBUG=true pass attacker-controlled input to a Tippy.js tooltip configured with allowHTML true, enabling DOM-based cross-site scripting when a user ho…

8.9Hoch

CVE-2026-48019 vor 2 Monaten

CRLF injection in Laravel's default email rule enables SMTP smuggling and spoofed-mail relay

laravel framework

Laravel is a web application framework. Prior to versions 12.60.0 and 13.10.0, a CRLF injection vulnerability in Laravel's email validation, in combination with how Symfony Mailer and Symfony Mime handle certain character sequences, may allow an unauthenticat…

6.5Mittel

CVE-2020-36950 vor 9 Monaten

Laravel Nova 3.7.0 - 'range' DoS

Laravel Holdings Inc. Laravel Nova

Laravel Nova 3.7.0 contains a denial of service vulnerability that allows authenticated users to crash the application by manipulating the 'range' parameter. Attackers can send simultaneous requests with an extremely high range value to overwhelm and crash th…

8.4Hoch

CVE-2021-47756 vor 9 Monaten

Laravel Valet 2.0.3 - Local Privilege Escalation (macOS)

Laravel Laravel Valet

Laravel Valet versions 1.1.4 to 2.0.3 contain a local privilege escalation vulnerability that allows users to modify the valet command with root privileges. Attackers can edit the symlinked valet command to execute arbitrary code with root permissions without…