GHSA-69RH-HCCR-CXRJ

Vulnerability from github – Published: 2025-05-27 19:47 – Updated: 2025-05-30 15:18
VLAI?
Summary
Laravel Rest Api has a Search Validation Bypass
Details

A validation bypass vulnerability was discovered prior to version 2.13.0, where multiple validations defined for the same attribute could be silently overridden. Due to how the framework merged validation rules across multiple contexts (such as index, store, and update actions), malicious actors could exploit this behavior by crafting requests that bypass expected validation rules, potentially injecting unexpected or dangerous parameters into the application.

Impact:

This could lead to unauthorized data being accepted or processed by the API, depending on the context in which the validation was bypassed.

Patch:

The issue was fixed in PR #172 by ensuring that multiple rule definitions are merged correctly rather than overwritten.

Severity ?
6.6 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "lomkit/laravel-rest-api"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.13.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-48490"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1173",
      "CWE-20"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-05-27T19:47:00Z",
    "nvd_published_at": "2025-05-30T06:15:28Z",
    "severity": "MODERATE"
  },
  "details": "A validation bypass vulnerability was discovered  prior to version 2.13.0, where multiple validations defined for the same attribute could be silently overridden. Due to how the framework merged validation rules across multiple contexts (such as index, store, and update actions), malicious actors could exploit this behavior by crafting requests that bypass expected validation rules, potentially injecting unexpected or dangerous parameters into the application.\n\nImpact:\n\nThis could lead to unauthorized data being accepted or processed by the API, depending on the context in which the validation was bypassed.\n\nPatch:\n\nThe issue was fixed in [PR #172](https://github.com/Lomkit/laravel-rest-api/pull/172) by ensuring that multiple rule definitions are merged correctly rather than overwritten.",
  "id": "GHSA-69rh-hccr-cxrj",
  "modified": "2025-05-30T15:18:00Z",
  "published": "2025-05-27T19:47:00Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Lomkit/laravel-rest-api/security/advisories/GHSA-69rh-hccr-cxrj"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48490"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Lomkit/laravel-rest-api/pull/172"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Lomkit/laravel-rest-api/commit/88b14587b4efd7e59d7379658c606d325bb513b4"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Lomkit/laravel-rest-api"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Laravel Rest Api has a Search Validation Bypass"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.