SB2021011552 - Input validation error in Laravel Framework

Description

This security bulletin contains information about 1 vulnerability.

1) Input validation error (CVE-ID: CVE-2021-21263)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause queries to return unexpected results.

The vulnerability exists due to improper input validation in the query builder when processing crafted request input that supplies an array where a scalar value is expected. A remote attacker can send specially crafted input to cause queries to return unexpected results.

Exploitation requires application code to pass unvalidated or uncast input to the query builder.

Remediation

Install update from vendor's website.

References

• https://github.com/laravel/framework/security/advisories/GHSA-3p32-j457-pg5x
• https://github.com/laravel/framework/pull/35865