CVE-2022-2886 Laravel deserialization

What is CVE-2022-2886?

CVE-2022-2886 is a medium-severity unsafe deserialization vulnerability in unspecified Laravel, published on 19 Aug 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

A vulnerability, which was classified as critical, was found in Laravel 5.1. Affected is an unknown function. The manipulation leads to deserialization. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-206688.

Weakness: CWE-502

Which versions are affected by CVE-2022-2886?

1 open source package ship an affected version, including laravel. It affects 1 product.

Products include Laravel Laravel.

How do I fix CVE-2022-2886?

Upgrade laravel to 5.1.47 or later.

Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.

Is CVE-2022-2886 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-2886 exists.

Other vulnerabilities in unspecified Laravel

• CVE-2018-15133 Laravel Deserialization of Untrusted Data Exploited High 8.1
• CVE-2021-28254 Deserialization in n/a Critical 9.8
• CVE-2020-24940 Guard bypass in Eloquent models affecting Laravel illuminate database component High 7.5
• CVE-2020-24941 Improper Input Validation in Laravel High 7.5
• CVE-2017-16894 Information disclosure in n/a High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BIT-laravel-2022-2886, GHSA-7236-phg4-48mj.