CVE-2024-52301

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2024-52301

Import Source

https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-52301.json

JSON Data

https://api.test.osv.dev/v1/vulns/CVE-2024-52301

Aliases

Downstream

CLSA (9)

DEBIAN (1)

DEBIAN-CVE-2024-52301

DLA-3997-1

Published

2024-11-12T19:32:14Z

Modified

2026-10-22T10:30:57Z

Severity

8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Laravel allows environment manipulation via query string

Details

Laravel is a web application framework. When the register_argc_argv php directive is set to on , and users call any URL with a special crafted query string, they are able to change the environment used by the framework when handling the request. The vulnerability fixed in 6.20.45, 7.30.7, 8.83.28, 9.52.17, 10.48.23, and 11.31.0. The framework now ignores argv values for environment detection on non-cli SAPIs.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-88"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/52xxx/CVE-2024-52301.json"
}

References

Affected packages

Git / github.com/laravel/framework

Affected ranges

Type

GIT

Repo

https://github.com/laravel/framework

Events

Introduced

Fixed

841d842bbdc8e08c6364a8c06212c7286bbf0b9a

Introduced

0b12ef19623c40e22eff91a4b48cb13b3b415b25

Fixed

0fe75bafb8703c6c8184792b91ce5e27ad80aa7b

Introduced

43bea00fd27c76c01fd009e46725a54885f4d2a5

Fixed

83e64679d0688ee83b9224b60831dcf4b1a812f7

Introduced

fbe7ed828819eadabb3cb9f95847a2ffe8846fd6

Fixed

a069cf17e4943fb88d2a91c92690004fb3236dab

Introduced

be2ddb5c31b0b9ebc2738d9f37a9d4c960aa3199

Fixed

625269ca4881d2b50eded2045cb930960a181d98

Introduced

6089f679d6d29e6071a6448ed5e96de02e57fedb

Fixed

365090ed2c68244e3141cdb5e247cdf3dfba2c40

Database specific

Show details

{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:laravel:framework:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "6.20.45"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:laravel:framework:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "7.0.0"
                },
                {
                    "fixed": "7.30.7"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:laravel:framework:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "8.0.0"
                },
                {
                    "fixed": "8.83.28"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:laravel:framework:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "9.0.0"
                },
                {
                    "fixed": "9.52.17"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:laravel:framework:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "10.0.0"
                },
                {
                    "fixed": "10.48.23"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:laravel:framework:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "11.0.0"
                },
                {
                    "fixed": "11.31.0"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "11.0"
                },
                {
                    "last_affected": "11.0"
                }
            ],
            "source": "CPE_STRING"
        }
    ]
}

Affected versions

v10.*

v10.0.0

v10.10.0

v10.10.1

v10.11.0

v10.12.0

v10.13.0

v10.13.1

v10.13.2

v10.13.3

v10.13.5

v10.14.0

v10.14.1

v10.15.0

v10.16.0

v10.16.1

v10.17.0

v10.17.1

v10.18.0

v10.19.0

v10.2.0

v10.20.0

v10.21.0

v10.21.1

v10.22.0

v10.23.0

v10.23.1

v10.24.0

v10.25.0

v10.25.1

v10.25.2

v10.26.0

v10.26.1

v10.26.2

v10.27.0

v10.28.0

v10.29.0

v10.3.0

v10.3.1

v10.3.2

v10.3.3

v10.30.0

v10.30.1

v10.31.0

v10.32.0

v10.32.1

v10.33.0

v10.34.0

v10.34.1

v10.34.2

v10.35.0

v10.36.0

v10.37.0

v10.37.1

v10.37.2

v10.37.3

v10.38.0

v10.38.1

v10.38.2

v10.39.0

v10.4.0

v10.4.1

v10.40.0

v10.41.0

v10.42.0

v10.43.0

v10.44.0

v10.45.0

v10.45.1

v10.46.0

v10.47.0

v10.48.0

v10.48.1

v10.48.10

v10.48.19

v10.48.2

v10.48.20

v10.48.21

v10.48.22

v10.48.3

v10.48.4

v10.48.5

v10.48.6

v10.48.7

v10.48.8

v10.48.9

v10.5.0

v10.5.1

v10.6.0

v10.6.1

v10.6.2

v10.7.0

v10.7.1

v10.8.0

v10.9.0

v11.*

v11.0.0

v11.0.1

v11.0.2

v11.0.3

v11.0.4

v11.0.5

v11.0.6

v11.0.7

v11.0.8

v11.1.0

v11.1.1

v11.10.0

v11.11.0

v11.11.1

v11.12.0

v11.13.0

v11.14.0

v11.15.0

v11.16.0

v11.17.0

v11.18.0

v11.18.1

v11.19.0

v11.2.0

v11.20.0

v11.21.0

v11.22.0

v11.23.0

v11.23.1

v11.23.2

v11.23.3

v11.23.4

v11.24.0

v11.24.1

v11.25.0

v11.26.0

v11.27.0

v11.27.1

v11.27.2

v11.28.0

v11.28.1

v11.29.0

v11.3.0

v11.3.1

v11.30.0

v11.4.0

v11.5.0

v11.6.0

v11.7.0

v11.8.0

v11.9.0

v11.9.1

v11.9.2

v4.*

v4.0.0

v4.0.0-BETA2

v4.0.0-BETA3

v4.0.0-BETA4

v4.1.0

v5.*

v5.5.0

v5.5.1

v6.*

v6.0.0

v6.0.1

v6.0.2

v6.0.3

v6.0.4

v6.1.0

v6.10.0

v6.10.1

v6.11.0

v6.12.0

v6.13.0

v6.13.1

v6.14.0

v6.15.0

v6.15.1

v6.16.0

v6.17.0

v6.17.1

v6.18.0

v6.18.1

v6.18.10

v6.18.11

v6.18.12

v6.18.13

v6.18.15

v6.18.16

v6.18.17

v6.18.18

v6.18.19

v6.18.2

v6.18.20

v6.18.21

v6.18.22

v6.18.23

v6.18.24

v6.18.25

v6.18.26

v6.18.27

v6.18.28

v6.18.29

v6.18.3

v6.18.30

v6.18.31

v6.18.32

v6.18.33

v6.18.34

v6.18.35

v6.18.36

v6.18.37

v6.18.38

v6.18.39

v6.18.4

v6.18.40

v6.18.41

v6.18.42

v6.18.43

v6.18.5

v6.18.6

v6.18.7

v6.18.8

v6.18.9

v6.19.0

v6.19.1

v6.2.0

v6.20.0

v6.20.1

v6.20.10

v6.20.11

v6.20.12

v6.20.13

v6.20.14

v6.20.15

v6.20.16

v6.20.17

v6.20.18

v6.20.19

v6.20.2

v6.20.20

v6.20.21

v6.20.22

v6.20.23

v6.20.24

v6.20.25

v6.20.28

v6.20.3

v6.20.30

v6.20.31

v6.20.32

v6.20.33

v6.20.34

v6.20.36

v6.20.37

v6.20.38

v6.20.39

v6.20.4

v6.20.40

v6.20.41

v6.20.42

v6.20.43

v6.20.44

v6.20.5

v6.20.6

v6.20.7

v6.20.8

v6.20.9

v6.3.0

v6.4.0

v6.4.1

v6.5.0

v6.5.1

v6.5.2

v6.6.0

v6.6.1

v6.6.2

v6.7.0

v6.8.0

v6.9.0

v7.*

v7.0.0

v7.0.1

v7.0.2

v7.0.3

v7.0.4

v7.0.5

v7.0.6

v7.0.7

v7.0.8

v7.1.0

v7.1.1

v7.1.2

v7.1.3

v7.10.0

v7.10.1

v7.10.2

v7.10.3

v7.11.0

v7.12.0

v7.13.0

v7.14.1

v7.15.0

v7.16.0

v7.16.1

v7.17.0

v7.17.1

v7.17.2

v7.18.0

v7.19.0

v7.19.1

v7.2.0

v7.2.1

v7.2.2

v7.20.0

v7.21.0

v7.22.0

v7.22.1

v7.22.2

v7.22.3

v7.22.4

v7.23.0

v7.23.1

v7.23.2

v7.24.0

v7.25.0

v7.26.0

v7.26.1

v7.27.0

v7.28.0

v7.28.1

v7.28.2

v7.28.3

v7.28.4

v7.29.0

v7.29.1

v7.29.2

v7.29.3

v7.3.0

v7.30.0

v7.30.1

v7.30.4

v7.30.5

v7.30.6

v7.4.0

v7.5.0

v7.5.1

v7.5.2

v7.6.0

v7.6.1

v7.6.2

v7.7.0

v7.7.1

v7.8.0

v7.8.1

v7.9.0

v7.9.1

v7.9.2

v8.*

v8.0.0

v8.0.1

v8.0.2

v8.0.3

v8.0.4

v8.1.0

v8.11.0

v8.11.1

v8.11.2

v8.12.0

v8.12.1

v8.12.2

v8.12.3

v8.13.0

v8.14.0

v8.15.0

v8.16.0

v8.17.0

v8.17.1

v8.17.2

v8.19.0

v8.2.0

v8.20.0

v8.20.1

v8.21.0

v8.22.0

v8.22.1

v8.23.0

v8.23.1

v8.24.0

v8.25.0

v8.26.0

v8.26.1

v8.27.0

v8.28.0

v8.28.1

v8.29.0

v8.3.0

v8.30.0

v8.30.1

v8.31.0

v8.32.0

v8.32.1

v8.33.0

v8.35.0

v8.35.1

v8.36.0

v8.38.0

v8.4.0

v8.40.0

v8.41.0

v8.42.0

v8.42.1

v8.43.0

v8.44.0

v8.45.0

v8.45.1

v8.46.0

v8.47.0

v8.48.0

v8.48.1

v8.48.2

v8.49.0

v8.49.1

v8.49.2

v8.5.0

v8.50.0

v8.51.0

v8.52.0

v8.53.0

v8.53.1

v8.54.0

v8.55.0

v8.56.0

v8.57.0

v8.58.0

v8.59.0

v8.6.0

v8.60.0

v8.61.0

v8.62.0

v8.63.0

v8.64.0

v8.65.0

v8.66.0

v8.67.0

v8.68.0

v8.7.0

v8.7.1

v8.70.0

v8.70.1

v8.70.2

v8.71.0

v8.72.0

v8.73.0

v8.73.1

v8.73.2

v8.74.0

v8.75.0

v8.76.2

v8.77.0

v8.77.1

v8.78.0

v8.8.0

v8.81.0

v8.82.0

v8.83.0

v8.83.1

v8.83.10

v8.83.11

v8.83.12

v8.83.13

v8.83.14

v8.83.16

v8.83.17

v8.83.18

v8.83.19

v8.83.2

v8.83.20

v8.83.24

v8.83.26

v8.83.27

v8.83.3

v8.83.4

v8.83.5

v8.83.7

v8.83.8

v8.83.9

v8.9.0

v9.*

v9.0.0

v9.0.1

v9.0.2

v9.1.0

v9.10.0

v9.10.1

v9.11.0

v9.12.0

v9.12.1

v9.12.2

v9.13.0

v9.14.0

v9.14.1

v9.15.0

v9.16.0

v9.17.0

v9.18.0

v9.19.0

v9.2.0

v9.20.0

v9.21.0

v9.21.1

v9.21.2

v9.21.3

v9.21.4

v9.21.5

v9.21.6

v9.22.0

v9.22.1

v9.23.0

v9.24.0

v9.25.0

v9.25.1

v9.26.0

v9.26.1

v9.27.0

v9.28.0

v9.29.0

v9.3.0

v9.3.1

v9.30.0

v9.30.1

v9.31.0

v9.32.0

v9.33.0

v9.34.0

v9.35.0

v9.35.1

v9.36.0

v9.36.1

v9.36.2

v9.36.3

v9.36.4

v9.37.0

v9.38.0

v9.39.0

v9.4.0

v9.4.1

v9.40.0

v9.40.1

v9.41.0

v9.42.0

v9.42.1

v9.42.2

v9.43.0

v9.44.0

v9.45.0

v9.45.1

v9.46.0

v9.47.0

v9.49.0

v9.5.0

v9.5.1

v9.50.0

v9.50.1

v9.50.2

v9.51.0

v9.52.0

v9.52.1

v9.52.10

v9.52.11

v9.52.12

v9.52.13

v9.52.14

v9.52.15

v9.52.16

v9.52.2

v9.52.3

v9.52.4

v9.52.5

v9.52.6

v9.52.7

v9.52.8

v9.52.9

v9.6.0

v9.7.0

v9.8.0

v9.8.1

v9.9.0

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-52301.json"