CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:N/I:P/A:N
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
EPSS
Percentile
39.7%
Laravel is a web application framework. Versions of Laravel before 6.20.11,
7.30.2 and 8.22.1 contain a query binding exploitation. This same exploit
applies to the illuminate/database package which is used by Laravel. If a
request is crafted where a field that is normally a non-array value is an
array, and that input is not validated or cast to its expected type before
being passed to the query builder, an unexpected number of query bindings
can be added to the query. In some situations, this will simply lead to no
results being returned by the query builder; however, it is possible
certain queries could be affected in a way that causes the query to return
unexpected results.
blog.laravel.com/security-laravel-62011-7302-8221-released
github.com/laravel/framework/pull/35865
github.com/laravel/framework/security/advisories/GHSA-3p32-j457-pg5x
launchpad.net/bugs/cve/CVE-2021-21263
nvd.nist.gov/vuln/detail/CVE-2021-21263
packagist.org/packages/illuminate/database
packagist.org/packages/laravel/framework
security-tracker.debian.org/tracker/CVE-2021-21263
www.cve.org/CVERecord?id=CVE-2021-21263
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:N/I:P/A:N
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
EPSS
Percentile
39.7%