{"id":"GHSA-7852-w36x-6mf6","aliases":[],"url":"https://o3.security/vulnerability/GHSA-7852-w36x-6mf6","summary":"Laravel Encrypter Component Potential Decryption Failure Leading to Unintended Behavior","details":"The Laravel Encrypter component is susceptible to a vulnerability that may result in decryption failure, leading to an unexpected return of `false`. Exploiting this issue requires the attacker to manipulate the encrypted payload before decryption. When combined with weak type comparisons in the application's code, such as the example below:\n\n```\n<?php\n\n$decyptedValue = decrypt($secret);\n\nif ($decryptedValue == '') {\n    // Code is run even though decrypted value is false...\n}\n```","published":"2024-05-15T22:08:06Z","modified":"2024-11-29T05:40:57.344982Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"laravel/framework","fixedVersion":"5.5.40"},{"ecosystem":"Packagist","name":"laravel/framework","fixedVersion":"5.6.15"}],"fix":{"url":"https://github.com/laravel/framework/commit/28e53f23a76206fb130e9a54eb95aa3f010e79c9","label":"laravel/framework@28e53f2"},"references":[{"type":"WEB","url":"https://github.com/laravel/framework/commit/28e53f23a76206fb130e9a54eb95aa3f010e79c9"},{"type":"WEB","url":"https://github.com/laravel/framework/commit/886d261df0854426b4662b7ed5db6a1c575a4279"},{"type":"WEB","url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/laravel/framework/2018-03-30-1.yaml"},{"type":"PACKAGE","url":"https://github.com/laravel/framework"},{"type":"WEB","url":"https://medium.com/@taylorotwell/laravel-security-release-5-6-15-and-5-5-40-56f1257933a0"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2024-11-29T05:40:57.344982Z"}}