CVE-2022-2870 laravel deserialization

What is CVE-2022-2870?

CVE-2022-2870 is a medium-severity unsafe deserialization vulnerability in unspecified laravel, published on 17 Aug 2022. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

A vulnerability was found in laravel 5.1 and classified as problematic. This issue affects some unknown processing. The manipulation leads to deserialization. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-206501 was assigned to this vulnerability.

Weakness: CWE-502

Which versions are affected by CVE-2022-2870?

1 open source package ship an affected version, including laravel. It affects 1 product.

Products include Laravel Laravel.

How do I fix CVE-2022-2870?

Upgrade laravel to 5.1.47 or later.

Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.

Is CVE-2022-2870 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-2870 exists.

Other vulnerabilities in unspecified laravel

• CVE-2018-15133 Laravel Deserialization of Untrusted Data Exploited High 8.1
• CVE-2021-28254 Deserialization in n/a Critical 9.8
• CVE-2020-24940 Guard bypass in Eloquent models affecting Laravel illuminate database component High 7.5
• CVE-2020-24941 Improper Input Validation in Laravel High 7.5
• CVE-2017-16894 Information disclosure in n/a High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BIT-laravel-2022-2870, GHSA-g4q4-r6rr-r4w2.