Vulnerability advisory

CVE-2020-24941

Published Sep 4, 2020Updated Oct 24, 2026OSV record ↗

Also known as BIT-laravel-2020-24941GHSA-w68r-5p45-5rqp

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected versions

Repository

Affected commits	Fixed by commit
GIT github.com/laravel/framework ↗
All commits before baec6c2d7f433594cb858c35c2a2946df7ecac13	`baec6c2d7f433594cb858c35c2a2946df7ecac13`
0b12ef19623c40e22eff91a4b48cb13b3b415b25 to before 71bfb1f2f89e4e31fba539d43fe287143e635e68	`71bfb1f2f89e4e31fba539d43fe287143e635e68`
Also listed as affected (130) `v6.18.34` `v7.23.2` `v7.23.1` `v6.18.33` `v7.23.0` `v6.18.32` `v7.22.4` `v6.18.31` `v7.22.3` `v6.18.30` `v7.22.2` `v6.18.29` `v7.22.1` `v6.18.28` `v7.22.0` `v6.18.27` `v7.21.0` `v6.18.26` `v7.20.0` `v6.18.25` `v7.19.1` `v7.19.0` `v6.18.24` `v6.18.23` `v7.18.0` `v6.18.22` `v7.17.2` `v6.18.21` `v7.17.1` `v7.17.0` `v7.16.1` `v6.18.20` `v7.16.0` `v6.18.19` `v7.15.0` `v6.18.18` `v7.14.1` `v6.18.17` `v7.13.0` `v6.18.16` `v7.12.0` `v6.18.15` `v7.11.0` `v7.10.3` `v7.10.2` `v6.18.13` `v7.10.1` `v7.10.0` `v6.18.12` `v6.18.11` `v7.9.2` `v7.9.1` `v7.9.0` `v7.8.1` `v7.8.0` `v6.18.10` `v7.7.1` `v6.18.9` `v7.7.0` `v7.6.2` `v6.18.8` `v6.18.7` `v7.6.1` `v7.6.0` `v7.5.2` `v6.18.6` `v7.5.1` `v6.18.5` `v6.18.4` `v7.5.0` `v7.4.0` `v6.18.3` `v7.3.0` `v7.2.2` `v7.2.1` `v6.18.2` `v7.2.0` `v7.1.3` `v7.1.2` `v7.1.1` `v6.18.1` `v7.1.0` `v7.0.8` `v7.0.7` `v7.0.6` `v7.0.5` `v7.0.4` `v7.0.3` `v6.18.0` `v7.0.2` `v7.0.1` `v7.0.0` `v6.17.1` `v6.17.0` `v6.16.0` `v6.15.1` `v6.15.0` `v6.14.0` `v6.13.1` `v6.13.0` `v6.12.0` `v6.11.0` `v6.10.1` `v6.10.0` `v6.9.0` `v6.8.0` `v6.7.0` `v6.6.2` `v6.6.1` `v6.6.0` `v6.5.2` `v6.5.1` `v6.5.0` `v6.4.1` `v6.4.0` `v6.3.0` `v6.2.0` `v6.1.0` `v6.0.4` `v6.0.3` `v6.0.2` `v6.0.1` `v6.0.0` `v5.5.1` `v5.5.0` `v4.1.0` `v4.0.0` `v4.0.0-BETA4` `v4.0.0-BETA3` `v4.0.0-BETA2`
GIT github.com/laravel/laravel ↗
All commits before 921b14b954d51125b8369299a6ba18d78735367d	`921b14b954d51125b8369299a6ba18d78735367d`
Also listed as affected (54) `v6.18.8` `v6.18.3` `v6.18.0` `v6.12.0` `v6.8.0` `v6.5.2` `v6.4.0` `v6.2.0` `v6.0.2` `v6.0.1` `v6.0.0` `v5.8.0` `v5.7.0` `v5.4.30` `v5.6.7` `v5.6.0` `v5.5.0` `v5.4.23` `v5.4.21` `v5.4.19` `v5.4.16` `v5.4.15` `v5.4.9` `v5.4.3` `v5.4.0` `v5.3.10` `v5.3.0` `v5.2.0` `v5.1.1` `v5.1.0` `v5.0.0` `v4.2.0` `v4.1.0` `v4.0.0` `v4.0.0-BETA4` `v3.2.13` `v4.0.0-BETA3` `v3.2.12` `v3.2.11` `v3.2.10` `v3.2.9` `v3.2.8` `v3.2.6` `v3.2.5` `v3.2.4` `v3.2.1` `v3.2.0-beta-2` `v3.2.0-beta-1` `v3.1.1` `v3.1.0` `v3.0.1` `v3.0.0` `v3.0.0-rc-2` `v3.0.0-beta-2`

Description

An issue was discovered in Laravel before 6.18.35 and 7.x before 7.24.0. The $guarded property is mishandled in some situations involving requests with JSON column nesting expressions.

References

Advisoryblog.laravel.com/security-release-laravel-61835-7240 ↗