CVE-2024-52301 - CVE House
Back to Database
Status published High CVE-2024-52301

Laravel allows environment manipulation via query string

Vulnerability Description

Laravel is a web application framework. When the register_argc_argv php directive is set to on , and users call any URL with a special crafted query string, they are able to change the environment used by the framework when handling the request. The vulnerability fixed in 6.20.45, 7.30.7, 8.83.28, 9.52.17, 10.48.23, and 11.31.0. The framework now ignores argv values for environment detection on non-cli SAPIs.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-52301

Credits & Attribution

No credits recorded in the NVD database.

References

More from laravel

View All →
CVE-2025-27515
Laravel has a File Validation Bypass
Medium 6.9
CVE-2024-55661
Laravel Pulse Allows Remote Code Execution via Unprotected Query Method
High 8.7
CVE-2024-50347
Laravel Reverb has Missing API Signature Verification
Medium 6.3
CVE-2022-40482
The authentication method in Laravel 8.x through 9.x before 9.32.0...
Unknown 0
CVE-2022-25838
Laravel Fortify before 1.11.1 allows reuse within a short time...
High 8.1

Affected Vendor

Affected Software

framework
Vulnerable Versions:
< 6.20.45, >= 7.0.0, < 7.30.7, >= 8.0.0, < 8.83.28, >= 9.0.0, < 9.52.17, >= 10.0.0, < 10.48.23, >= 11.0.0, < 11.31.0

Timeline

Official Publish: November 12th, 2024
Last Modified: December 21st, 2024
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-88

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1059 Command and Scripting Interpreter
Execution
T1068 Exploitation for Privilege Escalation
Privilege Escalation