Read the docs
TI-2020-15250 Aliases CVE-2020-24940GHSA-c7rm-w2hj-x8g3

An issue was discovered in Laravel before 6.18.34 and 7.x before 7.23.2.

Priority LOW 35CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.

Summary

An issue was discovered in Laravel before 6.18.34 and 7.x before 7.23.2. Unvalidated values are saved to the database in some situations in which table names are stripped during a mass assignment.

Why it matters now

EPSS 0.01203 68th percentileScored 2026-11-07
Fix Fixed illuminate/database (Packagist): 6.18.34, 7.23.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—illuminate/database (Packagist)5.5.0 – 5.5.44—No fix listedGHSA-c7rm-w2hj-x8g3
—illuminate/database (Packagist)6.0.0 to before 6.18.346.18.34Patch availableGHSA-c7rm-w2hj-x8g3
—illuminate/database (Packagist)7.0.0 to before 7.23.27.23.2Patch availableGHSA-c7rm-w2hj-x8g3
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • illuminate/database (Packagist) Vendor— Affected 5.5.0 – 5.5.44 Fixed in — No fix listed GHSA-c7rm-w2hj-x8g3
  • illuminate/database (Packagist) Vendor— Affected 6.0.0 to before 6.18.34 Fixed in 6.18.34 Patch available GHSA-c7rm-w2hj-x8g3
  • illuminate/database (Packagist) Vendor— Affected 7.0.0 to before 7.23.2 Fixed in 7.23.2 Patch available GHSA-c7rm-w2hj-x8g3

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:laravel:laravel:*:*:*:*:*:*:*:*before 6.18.34; 7.0.0 to before 7.23.2VulnerableLaravel
  • cpe:2.3:a:laravel:laravel:*:*:*:*:*:*:*:* Versions before 6.18.34; 7.0.0 to before 7.23.2 Vulnerable ·Laravel

Remediation

  • Fix · GHSA-c7rm-w2hj-x8g3 illuminate/database (Packagist) Fixed in 6.18.34 Advisory →
  • Fix · GHSA-c7rm-w2hj-x8g3 illuminate/database (Packagist) Fixed in 7.23.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-24940
  2. 2026-10-03 Alias added: GHSA-c7rm-w2hj-x8g3

References

Advisory 2

Other 2

  • TI-2018-10827 In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might… KEVCVSS 3.1HIGH 8.1
  • TI-2021-09454 A deserialization vulnerability in the destruct() function of Laravel v8.5.9 allows… CVSS 3.1CRITICAL 9.8
  • TI-2022-02662 laravel deserialization CVSS 3.1CRITICAL 9.8
  • TI-2017-12436 In Laravel framework through 5.5.21, remote attackers can obtain sensitive information… CVSS 3.0HIGH 7.5
  • TI-2022-02676 Laravel deserialization CVSS 3.1HIGH 8.8
  • TI-2021-04364 Query Binding Exploitation in Laravel CVSS 3.1HIGH 7.2
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences