CVE-2020-24940 Guard bypass in Eloquent models affecting Laravel illuminate database component

What is CVE-2020-24940?

CVE-2020-24940 is a high-severity vulnerability in n/a, published on 4 Sep 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An issue was discovered in Laravel before 6.18.34 and 7.x before 7.23.2. Unvalidated values are saved to the database in some situations in which table names are stripped during a mass assignment.

Weakness: CWE-20

Which versions are affected by CVE-2020-24940?

7 open source packages ship an affected version, including illuminate/database and laravel. It affects 1 product.

Products include Laravel Laravel.

How do I fix CVE-2020-24940?

Upgrade illuminate/database to a fixed version for your release line: 6.18.34 or 7.23.2.

Is CVE-2020-24940 being exploited?

There is no known exploitation of CVE-2020-24940 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2018-15133 Laravel Deserialization of Untrusted Data Exploited High 8.1
• CVE-2021-28254 Deserialization in n/a Critical 9.8
• CVE-2020-24941 Improper Input Validation in Laravel High 7.5
• CVE-2017-16894 Information disclosure in n/a High 7.5
• CVE-2021-21263 Query Binding Exploitation in Laravel High 7.2

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BIT-laravel-2020-24940, GHSA-c7rm-w2hj-x8g3.