Vulnerability advisory

CVE-2024-52301

Laravel allows environment manipulation via query string

Published Nov 12, 2024Updated Oct 28, 2026OSV record ↗

Also known as BIT-laravel-2024-52301GHSA-gv7v-rgg6-548h

Severity

CVSS 4.0CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Affected versions

Repository

Affected commits	Fixed by commit
GIT github.com/laravel/framework ↗
All commits before 841d842bbdc8e08c6364a8c06212c7286bbf0b9a	`841d842bbdc8e08c6364a8c06212c7286bbf0b9a`
0b12ef19623c40e22eff91a4b48cb13b3b415b25 to before 0fe75bafb8703c6c8184792b91ce5e27ad80aa7b	`0fe75bafb8703c6c8184792b91ce5e27ad80aa7b`
43bea00fd27c76c01fd009e46725a54885f4d2a5 to before 83e64679d0688ee83b9224b60831dcf4b1a812f7	`83e64679d0688ee83b9224b60831dcf4b1a812f7`
fbe7ed828819eadabb3cb9f95847a2ffe8846fd6 to before a069cf17e4943fb88d2a91c92690004fb3236dab	`a069cf17e4943fb88d2a91c92690004fb3236dab`
be2ddb5c31b0b9ebc2738d9f37a9d4c960aa3199 to before 625269ca4881d2b50eded2045cb930960a181d98	`625269ca4881d2b50eded2045cb930960a181d98`
6089f679d6d29e6071a6448ed5e96de02e57fedb to before 365090ed2c68244e3141cdb5e247cdf3dfba2c40	`365090ed2c68244e3141cdb5e247cdf3dfba2c40`
Also listed as affected (576) `v11.30.0` `v11.29.0` `v11.28.1` `v11.28.0` `v11.27.2` `v11.27.1` `v11.27.0` `v11.26.0` `v11.25.0` `v11.24.1` `v11.24.0` `v10.48.22` `v11.23.4` `v10.48.21` `v11.23.3` `v11.23.2` `v11.23.1` `v11.23.0` `v11.22.0` `v11.21.0` `v10.48.20` `v11.20.0` `v10.48.19` `v11.19.0` `v11.18.1` `v11.18.0` `v11.17.0` `v11.16.0` `v11.15.0` `v11.14.0` `v11.13.0` `v11.12.0` `v11.11.1` `v11.11.0` `v11.10.0` `v11.9.2` `v11.9.1` `v11.9.0` `v11.8.0` `v11.7.0` `v11.6.0` `v10.48.10` `v10.48.9` `v11.5.0` `v10.48.8` `v11.4.0` `v11.3.1` `v10.48.7` `v10.48.6` `v11.3.0` `v10.48.5` `v11.2.0` `v11.1.1` `v11.1.0` `v11.0.8` `v10.48.4` `v11.0.7` `v10.48.3` `v11.0.6` `v11.0.5` `v11.0.4` `v11.0.3` `v11.0.2` `v11.0.1` `v11.0.0` `v10.48.2` `v10.48.1` `v10.48.0` `v10.47.0` `v10.46.0` `v10.45.1` `v10.45.0` `v10.44.0` `v10.43.0` `v10.42.0` `v10.41.0` `v10.40.0` `v10.39.0` `v9.52.16` `v10.38.2` `v10.38.1` `v10.38.0` `v10.37.3` `v10.37.2` `v10.37.1` `v10.37.0` `v10.36.0` `v10.35.0` `v10.34.2` `v10.34.1` `v10.34.0` `v10.33.0` `v10.32.1` `v10.32.0` `v10.31.0` `v10.30.1` `v10.30.0` `v10.29.0` `v10.28.0` `v10.27.0` `v10.26.2` `v10.26.1` `v9.52.15` `v10.26.0` `v10.25.2` `v10.25.1` `v10.25.0` `v10.24.0` `v10.23.1` `v10.23.0` `v10.22.0` `v10.21.1` `v10.21.0` `v10.20.0` `v10.19.0` `v10.18.0` `v9.52.14` `v10.17.1` `v9.52.13` `v10.17.0` `v9.52.12` `v10.16.1` `v10.16.0` `v9.52.11` `v10.15.0` `v9.52.10` `v10.14.1` `v10.14.0` `v10.13.5` `v9.52.9` `v10.13.3` `v10.13.2` `v10.13.1` `v9.52.8` `v10.13.0` `v10.12.0` `v10.11.0` `v10.10.1` `v10.10.0` `v10.9.0` `v9.52.7` `v9.52.6` `v10.8.0` `v10.7.1` `v10.7.0` `v10.6.2` `v10.6.1` `v10.6.0` `v10.5.1` `v9.52.5` `v10.5.0` `v10.4.1` `v10.4.0` `v10.3.3` `v10.3.2` `v10.3.1` `v10.3.0` `v10.2.0` `v9.52.4` `v9.52.3` `v9.52.2` `v9.52.1` `v9.52.0` `v10.0.0` `v9.51.0` `v9.50.2` `v9.50.1` `v9.50.0` `v9.49.0` `v9.47.0` `v9.46.0` `v9.45.1` `v9.45.0` `v8.83.27` `v9.44.0` `v9.43.0` `v9.42.2` `v9.42.1` `v9.42.0` `v9.41.0` `v9.40.1` `v9.40.0` `v9.39.0` `v8.83.26` `v9.38.0` `v9.37.0` `v9.36.4` `v9.36.3` `v9.36.2` `v9.36.1` `v9.36.0` `v9.35.1` `v9.35.0` `v9.34.0` `v9.33.0` `v8.83.24` `v9.32.0` `v9.31.0` `v9.30.1` `v9.30.0` `v9.29.0` `v9.28.0` `v9.27.0` `v9.26.1` `v9.26.0` `v9.25.1` `v9.25.0` `v9.24.0` `v9.23.0` `v9.22.1` `v9.22.0` `v9.21.6` `v9.21.5` `v9.21.4` `v9.21.3` `v9.21.2` `v9.21.1` `v8.83.20` `v9.21.0` `v8.83.19` `v9.20.0` `v9.19.0` `v8.83.18` `v9.18.0` `v8.83.17` `v8.83.16` `v9.17.0` `v9.16.0` `v9.15.0` `v9.14.1` `v8.83.14` `v9.14.0` `v8.83.13` `v9.13.0` `v9.12.2` `v9.12.1` `v8.83.12` `v9.12.0` `v8.83.11` `v9.11.0` `v9.10.1` `v8.83.10` `v9.10.0` `v9.9.0` `v8.83.9` `v8.83.8` `v9.8.1` `v9.8.0` `v8.83.7` `v9.7.0` `v9.6.0` `v8.83.5` `v9.5.1` `v9.5.0` `v9.4.1` `v8.83.4` `v9.4.0` `v8.83.3` `v9.3.1` `v9.3.0` `v9.2.0` `v8.83.2` `v8.83.1` `v9.1.0` `v8.83.0` `v9.0.2` `v9.0.1` `v9.0.0` `v8.82.0` `v8.81.0` `v6.20.44` `v8.78.0` `v8.77.1` `v8.77.0` `v8.76.2` `v6.20.43` `v7.30.6` `v6.20.42` `v8.75.0` `v8.74.0` `v8.73.2` `v6.20.41` `v8.73.1` `v8.73.0` `v7.30.5` `v6.20.40` `v8.72.0` `v6.20.39` `v8.71.0` `v8.70.2` `v6.20.38` `v8.70.1` `v8.70.0` `v6.20.37` `v8.68.0` `v6.20.36` `v8.67.0` `v8.66.0` `v8.65.0` `v8.64.0` `v8.63.0` `v8.62.0` `v8.61.0` `v8.60.0` `v8.59.0` `v6.20.34` `v6.20.33` `v8.58.0` `v8.57.0` `v8.56.0` `v6.20.32` `v8.55.0` `v8.54.0` `v6.20.31` `v8.53.1` `v8.53.0` `v8.52.0` `v8.51.0` `v8.50.0` `v6.20.30` `v8.49.2` `v8.49.1` `v8.49.0` `v8.48.2` `v8.48.1` `v8.48.0` `v6.20.28` `v8.47.0` `v8.46.0` `v8.45.1` `v8.45.0` `v8.44.0` `v8.43.0` `v8.42.1` `v8.42.0` `v8.41.0` `v8.40.0` `v6.20.25` `v6.20.24` `v8.38.0` `v6.20.23` `v8.36.0` `v6.20.22` `v8.35.1` `v8.35.0` `v6.20.21` `v6.20.20` `v6.20.19` `v8.33.0` `v6.20.18` `v8.32.1` `v8.32.0` `v8.31.0` `v6.20.17` `v8.30.0` `v8.30.1` `v8.29.0` `v8.28.1` `v8.28.0` `v8.27.0` `v6.20.16` `v8.26.1` `v8.26.0` `v7.30.4` `v8.25.0` `v6.20.15` `v6.20.14` `v8.24.0` `v8.23.1` `v6.20.13` `v8.23.0` `v6.20.12` `v6.20.11` `v8.22.1` `v8.22.0` `v6.20.10` `v6.20.9` `v8.21.0` `v8.20.1` `v7.30.1` `v6.20.8` `v8.20.0` `v8.19.0` `v6.20.7` `v8.17.2` `v8.17.1` `v7.30.0` `v6.20.6` `v8.17.0` `v8.16.0` `v6.20.5` `v6.20.4` `v8.15.0` `v8.14.0` `v6.20.3` `v7.29.3` `v6.20.2` `v8.13.0` `v7.29.2` `v8.12.3` `v8.12.2` `v8.12.1` `v7.29.1` `v6.20.1` `v8.12.0` `v6.20.0` `v7.29.0` `v8.11.2` `v6.19.1` `v8.11.0` `v8.11.1` `v6.19.0` `v6.18.43` `v7.28.4` `v6.18.42` `v8.9.0` `v8.8.0` `v8.7.1` `v6.18.41` `v8.7.0` `v8.6.0` `v7.28.3` `v8.5.0` `v8.4.0` `v8.3.0` `v7.28.2` `v6.18.40` `v8.2.0` `v8.1.0` `v8.0.4` `v8.0.3` `v7.28.1` `v8.0.2` `v8.0.1` `v7.28.0` `v6.18.39` `v8.0.0` `v7.27.0` `v6.18.38` `v6.18.37` `v7.26.1` `v7.26.0` `v6.18.36` `v6.18.35` `v7.25.0` `v7.24.0` `v6.18.34` `v7.23.2` `v7.23.1` `v6.18.33` `v7.23.0` `v6.18.32` `v7.22.4` `v6.18.31` `v7.22.3` `v6.18.30` `v7.22.2` `v6.18.29` `v7.22.1` `v6.18.28` `v7.22.0` `v6.18.27` `v7.21.0` `v6.18.26` `v7.20.0` `v6.18.25` `v7.19.1` `v7.19.0` `v6.18.24` `v6.18.23` `v7.18.0` `v6.18.22` `v7.17.2` `v6.18.21` `v7.17.1` `v7.17.0` `v7.16.1` `v6.18.20` `v7.16.0` `v6.18.19` `v7.15.0` `v6.18.18` `v7.14.1` `v6.18.17` `v7.13.0` `v6.18.16` `v7.12.0` `v6.18.15` `v7.11.0` `v7.10.3` `v7.10.2` `v6.18.13` `v7.10.1` `v7.10.0` `v6.18.12` `v6.18.11` `v7.9.2` `v7.9.1` `v7.9.0` `v7.8.1` `v7.8.0` `v6.18.10` `v7.7.1` `v6.18.9` `v7.7.0` `v7.6.2` `v6.18.8` `v6.18.7` `v7.6.1` `v7.6.0` `v7.5.2` `v6.18.6` `v7.5.1` `v6.18.5` `v6.18.4` `v7.5.0` `v7.4.0` `v6.18.3` `v7.3.0` `v7.2.2` `v7.2.1` `v6.18.2` `v7.2.0` `v7.1.3` `v7.1.2` `v7.1.1` `v6.18.1` `v7.1.0` `v7.0.8` `v7.0.7` `v7.0.6` `v7.0.5` `v7.0.4` `v7.0.3` `v6.18.0` `v7.0.2` `v7.0.1` `v7.0.0` `v6.17.1` `v6.17.0` `v6.16.0` `v6.15.1` `v6.15.0` `v6.14.0` `v6.13.1` `v6.13.0` `v6.12.0` `v6.11.0` `v6.10.1` `v6.10.0` `v6.9.0` `v6.8.0` `v6.7.0` `v6.6.2` `v6.6.1` `v6.6.0` `v6.5.2` `v6.5.1` `v6.5.0` `v6.4.1` `v6.4.0` `v6.3.0` `v6.2.0` `v6.1.0` `v6.0.4` `v6.0.3` `v6.0.2` `v6.0.1` `v6.0.0` `v5.5.1` `v5.5.0` `v4.1.0` `v4.0.0` `v4.0.0-BETA4` `v4.0.0-BETA3` `v4.0.0-BETA2`

Description

Laravel is a web application framework. When the register_argc_argv php directive is set to on , and users call any URL with a special crafted query string, they are able to change the environment used by the framework when handling the request. The vulnerability fixed in 6.20.45, 7.30.7, 8.83.28, 9.52.17, 10.48.23, and 11.31.0. The framework now ignores argv values for environment detection on non-cli SAPIs.

CVE-2024-52301

Affected versions

Repository

Description

References