Read the docs
TI-2024-38671 Aliases GHSA-7852-w36x-6mf6

Laravel Encrypter Component Potential Decryption Failure Leading to Unintended Behavior

Priority LOW 38CWE-1240Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
—
Confidentiality · integrity · availability
—
Fix status
Fixed

No CVSS vector from any source. Fix status from GitHub.

Summary

The Laravel Encrypter component is susceptible to a vulnerability that may result in decryption failure, leading to an unexpected return of `false`. Exploiting this issue requires the attacker to manipulate the encrypted payload before decryption. When combined with weak type comparisons in the application's code, such as the example below: ``` <?php $decyptedValue = decrypt($secret); if ($decryptedValue == '') { // Code is run even though decrypted value is false... } ```

Why it matters now

Fix Fixed laravel/framework (Packagist): 5.5.40, 5.6.15

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—laravel/framework (Packagist)before 5.5.405.5.40Patch availableGHSA-7852-w36x-6mf6
—laravel/framework (Packagist)5.6.0 to before 5.6.155.6.15Patch availableGHSA-7852-w36x-6mf6
  • laravel/framework (Packagist) Vendor— Affected before 5.5.40 Fixed in 5.5.40 Patch available GHSA-7852-w36x-6mf6
  • laravel/framework (Packagist) Vendor— Affected 5.6.0 to before 5.6.15 Fixed in 5.6.15 Patch available GHSA-7852-w36x-6mf6

Remediation

  • Fix · GHSA-7852-w36x-6mf6 laravel/framework (Packagist) Fixed in 5.5.40 Advisory →
  • Fix · GHSA-7852-w36x-6mf6 laravel/framework (Packagist) Fixed in 5.6.15 Advisory →

Timeline

  1. 2026-10-03 Threatist record created from GHSA-7852-w36x-6mf6

References

Other 5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences