cvelistv5 - CVE-2024-52301

CVE-2024-52301 (GCVE-0-2024-52301)

Vulnerability from cvelistv5 – Published: 2024-11-12 19:32 – Updated: 2024-12-21 17:02

Summary

Laravel is a web application framework. When the register_argc_argv php directive is set to on , and users call any URL with a special crafted query string, they are able to change the environment used by the framework when handling the request. The vulnerability fixed in 6.20.45, 7.30.7, 8.83.28, 9.52.17, 10.48.23, and 11.31.0. The framework now ignores argv values for environment detection on non-cli SAPIs.

Severity ?

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

CWE

CWE-88 - Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

Assigner

GitHub_M

References

URL

Tags

https://github.com/laravel/framework/security/adv…

x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	laravel	framework	Affected: < 6.20.45 Affected: >= 7.0.0, < 7.30.7 Affected: >= 8.0.0, < 8.83.28 Affected: >= 9.0.0, < 9.52.17 Affected: >= 10.0.0, < 10.48.23 Affected: >= 11.0.0, < 11.31.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:laravel:framework:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "framework",
            "vendor": "laravel",
            "versions": [
              {
                "lessThan": "6.20.45",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "7.0.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              },
              {
                "lessThan": "7.30.7",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "8.0.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              },
              {
                "lessThan": "8.83.28",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "9.0.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              },
              {
                "lessThan": "9.52.17",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "10.0.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              },
              {
                "lessThan": "10.48.23",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "11.0.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              },
              {
                "lessThan": "11.31.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-52301",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-13T14:51:08.466106Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-21T16:14:52.925Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-12-21T17:02:39.839Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2024/12/msg00019.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "framework",
          "vendor": "laravel",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 6.20.45"
            },
            {
              "status": "affected",
              "version": "\u003e= 7.0.0, \u003c 7.30.7"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.0.0, \u003c 8.83.28"
            },
            {
              "status": "affected",
              "version": "\u003e= 9.0.0, \u003c 9.52.17"
            },
            {
              "status": "affected",
              "version": "\u003e= 10.0.0, \u003c 10.48.23"
            },
            {
              "status": "affected",
              "version": "\u003e= 11.0.0, \u003c 11.31.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Laravel is a web application framework. When the register_argc_argv php directive is set to on , and users call any URL with a special crafted query string, they are able to change the environment used by the framework when handling the request. The vulnerability fixed in 6.20.45, 7.30.7, 8.83.28, 9.52.17, 10.48.23, and 11.31.0. The framework now ignores argv values for environment detection on non-cli SAPIs."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-88",
              "description": "CWE-88: Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-11-12T19:32:14.415Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/laravel/framework/security/advisories/GHSA-gv7v-rgg6-548h",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/laravel/framework/security/advisories/GHSA-gv7v-rgg6-548h"
        }
      ],
      "source": {
        "advisory": "GHSA-gv7v-rgg6-548h",
        "discovery": "UNKNOWN"
      },
      "title": "Laravel allows environment manipulation via query string"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-52301",
    "datePublished": "2024-11-12T19:32:14.415Z",
    "dateReserved": "2024-11-06T19:00:26.396Z",
    "dateUpdated": "2024-12-21T17:02:39.839Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Laravel is a web application framework. When the register_argc_argv php directive is set to on , and users call any URL with a special crafted query string, they are able to change the environment used by the framework when handling the request. The vulnerability fixed in 6.20.45, 7.30.7, 8.83.28, 9.52.17, 10.48.23, and 11.31.0. The framework now ignores argv values for environment detection on non-cli SAPIs.\"}, {\"lang\": \"es\", \"value\": \"Laravel es un framework de aplicaciones web. Cuando la directiva de php register_argc_argv est\\u00e1 establecida en on y los usuarios llaman a cualquier URL con una cadena de consulta especialmente manipulada, pueden cambiar el entorno que utiliza el framework al procesar la solicitud. La vulnerabilidad se corrigi\\u00f3 en 6.20.45, 7.30.7, 8.83.28, 9.52.17, 10.48.23 y 11.31.0. El framework ahora ignora los valores argv para la detecci\\u00f3n del entorno en SAPI que no son de CLI.\"}]",
      "id": "CVE-2024-52301",
      "lastModified": "2024-12-21T17:15:18.207",
      "metrics": "{\"cvssMetricV40\": [{\"source\": \"security-advisories@github.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"4.0\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\", \"baseScore\": 8.7, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"vulnerableSystemConfidentiality\": \"NONE\", \"vulnerableSystemIntegrity\": \"HIGH\", \"vulnerableSystemAvailability\": \"NONE\", \"subsequentSystemConfidentiality\": \"NONE\", \"subsequentSystemIntegrity\": \"NONE\", \"subsequentSystemAvailability\": \"NONE\", \"exploitMaturity\": \"NOT_DEFINED\", \"confidentialityRequirements\": \"NOT_DEFINED\", \"integrityRequirements\": \"NOT_DEFINED\", \"availabilityRequirements\": \"NOT_DEFINED\", \"modifiedAttackVector\": \"NOT_DEFINED\", \"modifiedAttackComplexity\": \"NOT_DEFINED\", \"modifiedAttackRequirements\": \"NOT_DEFINED\", \"modifiedPrivilegesRequired\": \"NOT_DEFINED\", \"modifiedUserInteraction\": \"NOT_DEFINED\", \"modifiedVulnerableSystemConfidentiality\": \"NOT_DEFINED\", \"modifiedVulnerableSystemIntegrity\": \"NOT_DEFINED\", \"modifiedVulnerableSystemAvailability\": \"NOT_DEFINED\", \"modifiedSubsequentSystemConfidentiality\": \"NOT_DEFINED\", \"modifiedSubsequentSystemIntegrity\": \"NOT_DEFINED\", \"modifiedSubsequentSystemAvailability\": \"NOT_DEFINED\", \"safety\": \"NOT_DEFINED\", \"automatable\": \"NOT_DEFINED\", \"recovery\": \"NOT_DEFINED\", \"valueDensity\": \"NOT_DEFINED\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\", \"providerUrgency\": \"NOT_DEFINED\"}}]}",
      "published": "2024-11-12T20:15:14.087",
      "references": "[{\"url\": \"https://github.com/laravel/framework/security/advisories/GHSA-gv7v-rgg6-548h\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/12/msg00019.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "security-advisories@github.com",
      "vulnStatus": "Awaiting Analysis",
      "weaknesses": "[{\"source\": \"security-advisories@github.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-88\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-52301\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2024-11-12T20:15:14.087\",\"lastModified\":\"2025-08-26T02:37:14.610\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Laravel is a web application framework. When the register_argc_argv php directive is set to on , and users call any URL with a special crafted query string, they are able to change the environment used by the framework when handling the request. The vulnerability fixed in 6.20.45, 7.30.7, 8.83.28, 9.52.17, 10.48.23, and 11.31.0. The framework now ignores argv values for environment detection on non-cli SAPIs.\"},{\"lang\":\"es\",\"value\":\"Laravel es un framework de aplicaciones web. Cuando la directiva de php register_argc_argv est\u00e1 establecida en on y los usuarios llaman a cualquier URL con una cadena de consulta especialmente manipulada, pueden cambiar el entorno que utiliza el framework al procesar la solicitud. La vulnerabilidad se corrigi\u00f3 en 6.20.45, 7.30.7, 8.83.28, 9.52.17, 10.48.23 y 11.31.0. El framework ahora ignora los valores argv para la detecci\u00f3n del entorno en SAPI que no son de CLI.\"}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":8.7,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"NONE\",\"vulnIntegrityImpact\":\"HIGH\",\"vulnAvailabilityImpact\":\"NONE\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-88\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:laravel:framework:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"6.20.45\",\"matchCriteriaId\":\"0E4D3C77-8967-41A0-B092-AE27DA385578\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:laravel:framework:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"7.0.0\",\"versionEndExcluding\":\"7.30.7\",\"matchCriteriaId\":\"617A174E-7DE0-4145-BCE6-2A58CBBB6B21\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:laravel:framework:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.0.0\",\"versionEndExcluding\":\"8.83.28\",\"matchCriteriaId\":\"A506D04F-C9D9-4E37-B75F-29DA3943ECE0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:laravel:framework:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"9.0.0\",\"versionEndExcluding\":\"9.52.17\",\"matchCriteriaId\":\"BB7F8265-5DF9-49A5-9D23-A459F16A948F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:laravel:framework:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"10.0.0\",\"versionEndExcluding\":\"10.48.23\",\"matchCriteriaId\":\"9575B7A1-E291-4EC2-8557-ABCCACEB8622\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:laravel:framework:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"11.0.0\",\"versionEndExcluding\":\"11.31.0\",\"matchCriteriaId\":\"6346E858-7A00-4E7C-A3C2-8858C1D7C140\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FA6FEEC2-9F11-4643-8827-749718254FED\"}]}]}],\"references\":[{\"url\":\"https://github.com/laravel/framework/security/advisories/GHSA-gv7v-rgg6-548h\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2024/12/msg00019.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\",\"Mailing List\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://lists.debian.org/debian-lts-announce/2024/12/msg00019.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-12-21T17:02:39.839Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-52301\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-11-13T14:51:08.466106Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:laravel:framework:*:*:*:*:*:*:*:*\"], \"vendor\": \"laravel\", \"product\": \"framework\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"6.20.45\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"7.0.0\"}, {\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"7.30.7\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"8.0.0\"}, {\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"8.83.28\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"9.0.0\"}, {\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"9.52.17\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"10.0.0\"}, {\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"10.48.23\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"11.0.0\"}, {\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"11.31.0\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-11-13T14:47:40.395Z\"}}], \"cna\": {\"title\": \"Laravel allows environment manipulation via query string\", \"source\": {\"advisory\": \"GHSA-gv7v-rgg6-548h\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV4_0\": {\"version\": \"4.0\", \"baseScore\": 8.7, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"HIGH\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"NONE\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"NONE\"}}], \"affected\": [{\"vendor\": \"laravel\", \"product\": \"framework\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 6.20.45\"}, {\"status\": \"affected\", \"version\": \"\u003e= 7.0.0, \u003c 7.30.7\"}, {\"status\": \"affected\", \"version\": \"\u003e= 8.0.0, \u003c 8.83.28\"}, {\"status\": \"affected\", \"version\": \"\u003e= 9.0.0, \u003c 9.52.17\"}, {\"status\": \"affected\", \"version\": \"\u003e= 10.0.0, \u003c 10.48.23\"}, {\"status\": \"affected\", \"version\": \"\u003e= 11.0.0, \u003c 11.31.0\"}]}], \"references\": [{\"url\": \"https://github.com/laravel/framework/security/advisories/GHSA-gv7v-rgg6-548h\", \"name\": \"https://github.com/laravel/framework/security/advisories/GHSA-gv7v-rgg6-548h\", \"tags\": [\"x_refsource_CONFIRM\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Laravel is a web application framework. When the register_argc_argv php directive is set to on , and users call any URL with a special crafted query string, they are able to change the environment used by the framework when handling the request. The vulnerability fixed in 6.20.45, 7.30.7, 8.83.28, 9.52.17, 10.48.23, and 11.31.0. The framework now ignores argv values for environment detection on non-cli SAPIs.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-88\", \"description\": \"CWE-88: Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2024-11-12T19:32:14.415Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-52301\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-12-21T17:02:39.839Z\", \"dateReserved\": \"2024-11-06T19:00:26.396Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2024-11-12T19:32:14.415Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

GHSA-GV7V-RGG6-548H

Vulnerability from github – Published: 2024-11-12 22:08 – Updated: 2024-12-21 18:30

Summary

Laravel environment manipulation via query string

Details

Description

When the register_argc_argv php directive is set to on , and users call any URL with a special crafted query string, they are able to change the environment used by the framework when handling the request.

Resolution

The framework now ignores argv values for environment detection on non-cli SAPIs.

Severity ?

0.0 (None)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N

8.7 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "laravel/framework"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.20.45"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "laravel/framework"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "7.0.0"
            },
            {
              "fixed": "7.30.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "laravel/framework"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.83.28"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "laravel/framework"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.52.17"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "laravel/framework"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.48.23"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "laravel/framework"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0"
            },
            {
              "fixed": "11.31.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-52301"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-88"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-11-12T22:08:42Z",
    "nvd_published_at": "2024-11-12T20:15:14Z",
    "severity": "HIGH"
  },
  "details": "## Description\n\nWhen the `register_argc_argv php` directive is set to `on` , and users call any URL with a special crafted query string, they are able to change the environment used by the framework when handling the request.\n\n## Resolution\n\nThe framework now ignores argv values for environment detection on non-cli SAPIs.",
  "id": "GHSA-gv7v-rgg6-548h",
  "modified": "2024-12-21T18:30:49Z",
  "published": "2024-11-12T22:08:42Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/laravel/framework/security/advisories/GHSA-gv7v-rgg6-548h"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52301"
    },
    {
      "type": "WEB",
      "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/laravel/framework/CVE-2024-52301.yaml"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-gv7v-rgg6-548h"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/laravel/framework"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2024/12/msg00019.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Laravel environment manipulation via query string"
}

FKIE_CVE-2024-52301

Vulnerability from fkie_nvd - Published: 2024-11-12 20:15 - Updated: 2025-08-26 02:37

Severity ?

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/laravel/framework/security/advisories/GHSA-gv7v-rgg6-548h	Vendor Advisory
	af854a3a-2127-422b-91ae-364da2661108	https://lists.debian.org/debian-lts-announce/2024/12/msg00019.html	Third Party Advisory, Mailing List

Impacted products

Vendor	Product	Version
laravel	framework	*
laravel	framework	*
laravel	framework	*
laravel	framework	*
laravel	framework	*
laravel	framework	*
debian	debian_linux	11.0

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:laravel:framework:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "0E4D3C77-8967-41A0-B092-AE27DA385578",
              "versionEndExcluding": "6.20.45",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:laravel:framework:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "617A174E-7DE0-4145-BCE6-2A58CBBB6B21",
              "versionEndExcluding": "7.30.7",
              "versionStartIncluding": "7.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:laravel:framework:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "A506D04F-C9D9-4E37-B75F-29DA3943ECE0",
              "versionEndExcluding": "8.83.28",
              "versionStartIncluding": "8.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:laravel:framework:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "BB7F8265-5DF9-49A5-9D23-A459F16A948F",
              "versionEndExcluding": "9.52.17",
              "versionStartIncluding": "9.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:laravel:framework:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "9575B7A1-E291-4EC2-8557-ABCCACEB8622",
              "versionEndExcluding": "10.48.23",
              "versionStartIncluding": "10.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:laravel:framework:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "6346E858-7A00-4E7C-A3C2-8858C1D7C140",
              "versionEndExcluding": "11.31.0",
              "versionStartIncluding": "11.0.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Laravel is a web application framework. When the register_argc_argv php directive is set to on , and users call any URL with a special crafted query string, they are able to change the environment used by the framework when handling the request. The vulnerability fixed in 6.20.45, 7.30.7, 8.83.28, 9.52.17, 10.48.23, and 11.31.0. The framework now ignores argv values for environment detection on non-cli SAPIs."
    },
    {
      "lang": "es",
      "value": "Laravel es un framework de aplicaciones web. Cuando la directiva de php register_argc_argv est\u00e1 establecida en on y los usuarios llaman a cualquier URL con una cadena de consulta especialmente manipulada, pueden cambiar el entorno que utiliza el framework al procesar la solicitud. La vulnerabilidad se corrigi\u00f3 en 6.20.45, 7.30.7, 8.83.28, 9.52.17, 10.48.23 y 11.31.0. El framework ahora ignora los valores argv para la detecci\u00f3n del entorno en SAPI que no son de CLI."
    }
  ],
  "id": "CVE-2024-52301",
  "lastModified": "2025-08-26T02:37:14.610",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 8.7,
          "baseSeverity": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "HIGH",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2024-11-12T20:15:14.087",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://github.com/laravel/framework/security/advisories/GHSA-gv7v-rgg6-548h"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "Mailing List"
      ],
      "url": "https://lists.debian.org/debian-lts-announce/2024/12/msg00019.html"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-88"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

WID-SEC-W-2024-3498

Vulnerability from csaf_certbund - Published: 2024-11-18 23:00 - Updated: 2024-12-22 23:00

Summary

Laravel Framework: Schwachstelle ermöglicht Manipulation von Daten

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung

Laravel ist ein in PHP geschriebenes Framework für Webanwendungen.

Angriff

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Laravel Framework ausnutzen, um Daten zu manipulieren.

Betroffene Betriebssysteme

- Linux - Sonstiges - UNIX - Windows

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "mittel"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Laravel ist ein in PHP geschriebenes Framework f\u00fcr Webanwendungen.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Laravel Framework ausnutzen, um Daten zu manipulieren.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Linux\n- Sonstiges\n- UNIX\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2024-3498 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-3498.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2024-3498 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-3498"
      },
      {
        "category": "external",
        "summary": "Laravel GitHub vom 2024-11-18",
        "url": "https://github.com/laravel/framework/security/advisories/GHSA-gv7v-rgg6-548h"
      },
      {
        "category": "external",
        "summary": "NIST Vulnerability Database vom 2024-11-18",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52301"
      },
      {
        "category": "external",
        "summary": "Debian Security Advisory DLA-3997 vom 2024-12-21",
        "url": "https://lists.debian.org/debian-lts-announce/2024/12/msg00019.html"
      }
    ],
    "source_lang": "en-US",
    "title": "Laravel Framework: Schwachstelle erm\u00f6glicht Manipulation von Daten",
    "tracking": {
      "current_release_date": "2024-12-22T23:00:00.000+00:00",
      "generator": {
        "date": "2024-12-23T09:12:42.456+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.3.10"
        }
      },
      "id": "WID-SEC-W-2024-3498",
      "initial_release_date": "2024-11-18T23:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2024-11-18T23:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2024-12-22T23:00:00.000+00:00",
          "number": "2",
          "summary": "Neue Updates von Debian aufgenommen"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Debian Linux",
            "product": {
              "name": "Debian Linux",
              "product_id": "2951",
              "product_identification_helper": {
                "cpe": "cpe:/o:debian:debian_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Debian"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c6.20.45",
                "product": {
                  "name": "Open Source Laravel Framework \u003c6.20.45",
                  "product_id": "T039259"
                }
              },
              {
                "category": "product_version",
                "name": "6.20.45",
                "product": {
                  "name": "Open Source Laravel Framework 6.20.45",
                  "product_id": "T039259-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:laravel:framework:6.20.45"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c7.30.7",
                "product": {
                  "name": "Open Source Laravel Framework \u003c7.30.7",
                  "product_id": "T039261"
                }
              },
              {
                "category": "product_version",
                "name": "7.30.7",
                "product": {
                  "name": "Open Source Laravel Framework 7.30.7",
                  "product_id": "T039261-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:laravel:framework:7.30.7"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c8.83.28",
                "product": {
                  "name": "Open Source Laravel Framework \u003c8.83.28",
                  "product_id": "T039262"
                }
              },
              {
                "category": "product_version",
                "name": "8.83.28",
                "product": {
                  "name": "Open Source Laravel Framework 8.83.28",
                  "product_id": "T039262-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:laravel:framework:8.83.28"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c9.52.17",
                "product": {
                  "name": "Open Source Laravel Framework \u003c9.52.17",
                  "product_id": "T039263"
                }
              },
              {
                "category": "product_version",
                "name": "9.52.17",
                "product": {
                  "name": "Open Source Laravel Framework 9.52.17",
                  "product_id": "T039263-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:laravel:framework:9.52.17"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c10.48.23",
                "product": {
                  "name": "Open Source Laravel Framework \u003c10.48.23",
                  "product_id": "T039264"
                }
              },
              {
                "category": "product_version",
                "name": "10.48.23",
                "product": {
                  "name": "Open Source Laravel Framework 10.48.23",
                  "product_id": "T039264-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:laravel:framework:10.48.23"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c11.31.0",
                "product": {
                  "name": "Open Source Laravel Framework \u003c11.31.0",
                  "product_id": "T039265"
                }
              },
              {
                "category": "product_version",
                "name": "11.31.0",
                "product": {
                  "name": "Open Source Laravel Framework 11.31.0",
                  "product_id": "T039265-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:laravel:framework:11.31.0"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Laravel Framework"
          }
        ],
        "category": "vendor",
        "name": "Open Source"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-52301",
      "notes": [
        {
          "category": "description",
          "text": "Es existiert eine Schwachstelle in Laravel Framework. Bei aktivierter php-Direktive register_argc_argv kann mit der Nutzung von URLs mit einem speziellen Query-String die vom Framework bei der Bearbeitung der Anfrage verwendete Umgebung ge\u00e4ndert werden. Ein entfernter, anonymer Angreifer kann diese Schwachstelle ausnutzen, um Daten zu manipuliern."
        }
      ],
      "product_status": {
        "known_affected": [
          "T039263",
          "T039262",
          "T039265",
          "T039264",
          "2951",
          "T039261",
          "T039259"
        ]
      },
      "release_date": "2024-11-18T23:00:00.000+00:00",
      "title": "CVE-2024-52301"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2024-52301 (GCVE-0-2024-52301)

GHSA-GV7V-RGG6-548H

Description

Resolution

FKIE_CVE-2024-52301

WID-SEC-W-2024-3498

Tags

Sightings

Nomenclature