CVE-2020-24941 Improper Input Validation in Laravel

What is CVE-2020-24941?

CVE-2020-24941 is a high-severity missing authorization vulnerability in n/a, published on 4 Sep 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An issue was discovered in Laravel before 6.18.35 and 7.x before 7.24.0. The $guarded property is mishandled in some situations involving requests with JSON column nesting expressions.

Weakness: CWE-863

Which versions are affected by CVE-2020-24941?

5 open source packages ship an affected version, including laravel/framework and laravel. It affects 1 product.

Products include Laravel Laravel.

How do I fix CVE-2020-24941?

Upgrade laravel/framework to a fixed version for your release line: 6.18.35 or 7.24.0.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2020-24941 being exploited?

There is no known exploitation of CVE-2020-24941 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2018-15133 Laravel Deserialization of Untrusted Data Exploited High 8.1
• CVE-2021-28254 Deserialization in n/a Critical 9.8
• CVE-2020-24940 Guard bypass in Eloquent models affecting Laravel illuminate database component High 7.5
• CVE-2017-16894 Information disclosure in n/a High 7.5
• CVE-2021-21263 Query Binding Exploitation in Laravel High 7.2

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BIT-laravel-2020-24941, GHSA-w68r-5p45-5rqp.