Vulnerability in Laravel Framework
CVE-2021-21263
Laravel is a web application framework. Versions of Laravel before 6.20.11, 7.30.2 and 8.22.1 contain a query binding exploitation. This same exploit applies to the illuminate/database package which is used by Laravel. If a request is craf…
EPSS: 0.011 (78.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N.
Affected products
- Laravel Framework — versions >= 6.0.0, < 6.20.11, >= 7.0.0, < 7.30.2, >= 8.0.0, < 8.22.1
Weakness classification (CWE)
Public proof-of-concept exploits
References
- github.com/laravel/framework/security/advisories/GHSA-3p32-j457-pg5x (x_refsource_CONFIRM)
- github.com/laravel/framework/pull/35865 (x_refsource_MISC)
- blog.laravel.com/security-laravel-62011-7302-8221-released (x_refsource_MISC)
- packagist.org/packages/laravel/framework (x_refsource_MISC)
- packagist.org/packages/illuminate/database (x_refsource_MISC)
Frequently asked questions
- What is CVE-2021-21263?
- CVE-2021-21263 is a high-severity vulnerability in Laravel Framework, classified under Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection). CVSS score: 7.2/10. Published 2021-01-19.
- How severe is CVE-2021-21263?
- High severity. CVSS v3 base score is 7.2 out of 10.
- Is CVE-2021-21263 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.