GHSA-7FJP-G4M7-FX23低危已审查

User (Encrypted) Password Field Being Serialised

OSV 1.4.0 · github-reviewed · 修改于 2021-04-13 04:05

发布时间

2021-04-13 23:12

GitHub 审查时间

2021-04-13 04:05

NVD 发布时间

—

源文件

advisories/github-reviewed/2021/04/GHSA-7fjp-g4m7-fx23/GHSA-7fjp-g4m7-fx23.json

公告说明

Impact

Leaking Password field during serialisation of the User model. Password is in the encrypted form but if User model is requested in json or array form the value is printed.

Patches

Issue has been patched in version 0.3.7-beta and onwards.

Workarounds

Add the 'password' field to the Users model file in the hidden array:


    /**
     * The attributes that should be hidden for arrays.
     *
     * @var array
     */
    protected $hidden = [
        'remember_token',
        'password',
    ];

For more information

If you have any questions or comments about this advisory:

Open an issue in pwweb/laravel-core
Email us at [email protected]

受影响的软件包

Packagist

pwweb/laravel-core

标识信息

别名 / CVE

无

CWE

CWE-200

软件生态

Packagist

扩展资料

暂无扩展资料。

CVSS 评分

没有 CVSS 数据。

原始 OSV JSON

{
  "id": "GHSA-7fjp-g4m7-fx23",
  "aliases": [],
  "details": "### Impact\nLeaking Password field during serialisation of the User model. Password is in the encrypted form but if User model is requested in json or array form the value is printed.\n\n### Patches\nIssue has been patched in version 0.3.7-beta and onwards.\n\n### Workarounds\nAdd the 'password' field to the Users model file in the hidden array:\n\n```php\n\n    /**\n     * The attributes that should be hidden for arrays.\n     *\n     * @var array\n     */\n    protected $hidden = [\n        'remember_token',\n        'password',\n    ];\n```\n\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [pwweb/laravel-core](https://github.com/pwweb/laravel-core)\n* Email us at [[email protected]](mailto:[email protected])",
  "summary": "User (Encrypted) Password Field Being Serialised",
  "affected": [
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.3.7-beta"
            }
          ]
        }
      ],
      "package": {
        "name": "pwweb/laravel-core",
        "ecosystem": "Packagist"
      },
      "database_specific": {
        "last_known_affected_version_range": "<= 0.3.6-beta"
      }
    }
  ],
  "modified": "2021-04-12T20:05:57Z",
  "severity": [],
  "published": "2021-04-13T15:12:26Z",
  "references": [
    {
      "url": "https://github.com/pwweb/laravel-core/security/advisories/GHSA-7fjp-g4m7-fx23",
      "type": "WEB"
    }
  ],
  "schema_version": "1.4.0",
  "database_specific": {
    "cwe_ids": [
      "CWE-200"
    ],
    "severity": "LOW",
    "github_reviewed": true,
    "nvd_published_at": null,
    "github_reviewed_at": "2021-04-12T20:05:57Z"
  }
}