CVE-2022-30778
Laravel vulnerability analysis and mitigation

Overview

Laravel 9.1.8, when processing attacker-controlled data for deserialization, allowed potential Remote Code Execution via an unserialize pop chain in __destruct in Illuminate\Broadcasting\PendingBroadcast.php and dispatch($command) in Illuminate\Bus\QueueingDispatcher.php. However, this CVE was later rejected as it was determined not to be a security issue after further investigation by the CNA (NVD).

Technical details

The vulnerability was initially reported as a deserialization issue in Laravel 9.1.8 that could potentially lead to Remote Code Execution through a specific pop chain involving the __destruct method in PendingBroadcast.php and the dispatch($command) function in QueueingDispatcher.php (NVD).

Impact

Initially, the vulnerability was thought to potentially allow Remote Code Execution, which could have led to complete system compromise. However, after further investigation, it was determined not to be a security issue (NVD).

Mitigation and workarounds

No mitigation was necessary as the reported issue was determined not to be a security vulnerability after further investigation (NVD).

Additional resources


SourceThis report was generated using AI

Related Laravel vulnerabilities:

CVE ID

Severity

Score

Technologies

Component name

CISA KEV exploit

Has fix

Published date

CVE-2021-28254CRITICAL9.8
  • LaravelLaravel
  • cpe:2.3:a:laravel:laravel
NoYesApr 19, 2023
CVE-2022-2870CRITICAL9.8
  • LaravelLaravel
  • cpe:2.3:a:laravel:laravel
NoYesAug 17, 2022
CVE-2022-2886HIGH8.8
  • LaravelLaravel
  • cpe:2.3:a:laravel:laravel
NoYesAug 19, 2022
CVE-2024-55661HIGH8.7
  • PHPPHP
  • pulse
NoYesDec 13, 2024
CVE-2024-50347MEDIUM6.3
  • PHPPHP
  • cpe:2.3:a:laravel:laravel
NoYesOct 31, 2024

Free Vulnerability Assessment

Benchmark your Cloud Security Posture

Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.

Request assessment

Get a personalized demo

Ready to see Wiz in action?

"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management