Vulnerability advisory

GHSA-rc8x-jrrc-frfv

Laravel does not properly constrain the host portion of a password-reset URL

Published May 17, 2022Updated Apr 25, 2024OSV record ↗

Also known as CVE-2017-9303

Severity

CVSS 3.xCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected versions

laravel/laravel Packagist

All laravel/laravel advisories →

Affected	Fixed in
`5.4.0` to before 5.4.22	`5.4.22`Advisories →
Also listed as affected (7) `v5.4.0` `v5.4.15` `v5.4.16` `v5.4.19` `v5.4.21` `v5.4.3` `v5.4.9`

illuminate/auth Packagist

All illuminate/auth advisories →

Affected	Fixed in
`5.3.0` through `5.3.31`	No fix listed
Also listed as affected (4) `v5.3.0` `v5.3.16` `v5.3.23` `v5.3.4`
`5.4.0` to before 5.4.22	`5.4.22`Advisories →
Also listed as affected (5) `v5.4.0` `v5.4.13` `v5.4.17` `v5.4.19` `v5.4.9`

laravel/framework Packagist

All laravel/framework advisories →

Affected	Fixed in
`5.3.0` through `5.3.31`	No fix listed
Also listed as affected (32) `v5.3.0` `v5.3.1` `v5.3.10` `v5.3.11` `v5.3.12` `v5.3.13` `v5.3.14` `v5.3.15` `v5.3.16` `v5.3.17` `v5.3.18` `v5.3.19` `v5.3.2` `v5.3.20` `v5.3.21` `v5.3.22` `v5.3.23` `v5.3.24` `v5.3.25` `v5.3.26` `v5.3.27` `v5.3.28` `v5.3.29` `v5.3.3` `v5.3.30` `v5.3.31` `v5.3.4` `v5.3.5` `v5.3.6` `v5.3.7` `v5.3.8` `v5.3.9`
`5.4.0` to before 5.4.22	`5.4.22`Advisories →
Also listed as affected (22) `v5.4.0` `v5.4.1` `v5.4.10` `v5.4.11` `v5.4.12` `v5.4.13` `v5.4.14` `v5.4.15` `v5.4.16` `v5.4.17` `v5.4.18` `v5.4.19` `v5.4.2` `v5.4.20` `v5.4.21` `v5.4.3` `v5.4.4` `v5.4.5` `v5.4.6` `v5.4.7` `v5.4.8` `v5.4.9`

Description

Laravel 5.4.x before 5.4.22 does not properly constrain the host portion of a password-reset URL, which makes it easier for remote attackers to conduct phishing attacks by specifying an attacker-controlled host.