8.1Yüksek KEV

CVE-2018-15133Laravel Deserialization of Untrusted Data Vulnerability

laravel laravel Yayım: 2018-08-09 22:00 (8 yıl önce)

Aktif olarak istismar ediliyor — Laravel Deserialization of Untrusted Data Vulnerability

CISA bu açığın gerçek saldırılarda kullanıldığını 16.01.2024 tarihinde doğruladı. ABD federal kurumları için düzeltme son tarihi: 06.02.2024.

Gerekli işlem: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. https://laravel.com/docs/5.6/upgrade#upgrade-5.6.30; https://nvd.nist.gov/vuln/detail/CVE-2018-15133

Açıklama

In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unserialize call on a potentially untrusted X-XSRF-TOKEN value. This involves the decrypt method in Illuminate/Encryption/Encrypter.php and PendingBroadcast in gadgetchains/Laravel/RCE/3/chain.php in phpggc. The attacker must know the application key, which normally would never occur, but could happen if the attacker previously had privileged access or successfully accomplished a previous attack.

Zayıflık türü (CWE): CWE-502

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

Üretici	Ürün	Sürümler
laravel	laravel	≤ 5.5.40

Kaynaklar ve yamalar

https://laravel.com/docs/5.6/upgrade#upgrade-5.6.30 Vendor Advisory
http://packetstormsecurity.com/files/153641/PHP-Laravel-Framework-Token-Unserialize-Remote-Command-Execution.html ExploitThird Party AdvisoryVDB Entry
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-15133 US Government Resource

CPE eşleşmeleri (NVD) (2)

cpe:2.3:a:laravel:laravel:*:*:*:*:*:*:*:* ≤ 5.5.40
cpe:2.3:a:laravel:laravel:*:*:*:*:*:*:*:* ≥ 5.6.0 ≤ 5.6.29

CVSS puanı

8.1Yüksek

Kaynak: CISA-ADP · CVSS 3.1

Saldırı yolu: Ağ
Karmaşıklık: Yüksek
Gereken yetki: Yok
Kullanıcı etkileşimi: Gerekmez
Kapsam: Değişmez
Gizlilik: Yüksek
Bütünlük: Yüksek
Erişilebilirlik: Yüksek

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Tüm puanlar (4)

CISA-ADP	CVSS 3.1	8.1Yüksek
nvd	CVSS 3.1	8.1Yüksek
134c704f-9b21-4f2e-91b3-4a467353bcc0	CVSS 3.1	8.1Yüksek
nvd	CVSS 2.0	6.8Orta

EPSS (30 günde istismar olasılığı)

76.57%

tüm CVE'lerin %100'inden yüksek

CISA değerlendirmesi (SSVC)

İstismar: active
Otomatikleştirilebilir: no
Teknik etki: total

Zaman çizelgesi

Numara ayrıldı2018-08-07
Yayımlandı2018-08-09 22:00
IP-DB'ye ulaştı2026-10-24 23:31
KEV'e eklendi2024-01-16
Son güncelleme2026-06-17 04:42

Numarayı veren (CNA): mitre
NVD durumu: Analyzed

Kaynakta görüntüle: CVE.org · NVD

Bu ürünlerde yeni bir açık çıktığında haber alın

E-posta uyarılarını aç

Ücretsiz · üyelikle · istediğiniz an kapatılır

Aynı üründe son açıklar — Laravel

2.3Düşük

CVE-2026-128083 17 saat önce

Laravel: Task Output Injection - Concurrency Process

laravel framework

Laravel is a web application framework. Prior to 12.71.0 and 13.40.0, Laravel's Concurrency::run process driver can treat a forged internal result message in child standard output as framework output. An application route must invoke Concurrency::run, and a t…

9.2Kritik

CVE-2026-114509 23 gün önce

Laravel TokenGuard authentication bypass through non-string API credentials

laravel framework

Laravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard configured as a standard token-based API guard does not reject a crafted non-string credential. Under affected MySQL or MariaDB configurations, the authentication lookup can matc…

1.8%EPSS

6.5Orta

CVE-2026-114508 23 gün önce

Laravel relationship inclusion can trigger unauthorized data destruction

laravel framework

Laravel is a web application framework. From 12.45.0 until 12.68.0 and 13.27.0, crafted relationship inclusion on a read-only endpoint can trigger a destructive database operation on a related table instead of retrieving data. A user with read access but no w…

3.1Düşük

CVE-2026-102279 1 ay önce

Laravel: XSS in Debug Page Information

laravel framework

Laravel is a web application framework. Prior to 12.69.0 and 13.30.0, Laravel exception debug pages with APP_DEBUG=true pass attacker-controlled input to a Tippy.js tooltip configured with allowHTML true, enabling DOM-based cross-site scripting when a user ho…

8.9Yüksek

CVE-2026-48019 2 ay önce

CRLF injection in Laravel's default email rule enables SMTP smuggling and spoofed-mail relay

laravel framework

Laravel is a web application framework. Prior to versions 12.60.0 and 13.10.0, a CRLF injection vulnerability in Laravel's email validation, in combination with how Symfony Mailer and Symfony Mime handle certain character sequences, may allow an unauthenticat…

6.5Orta

CVE-2020-36950 9 ay önce

Laravel Nova 3.7.0 - 'range' DoS

Laravel Holdings Inc. Laravel Nova

Laravel Nova 3.7.0 contains a denial of service vulnerability that allows authenticated users to crash the application by manipulating the 'range' parameter. Attackers can send simultaneous requests with an extremely high range value to overwhelm and crash th…