critical9.8
CVE-2022-31279
Unserialized Pop Chain in Laravel
Impact
## Withdrawn This advisory has been withdrawn because it is not a security issue and the CVE has been revoked. ## Original Description Laravel 9.1.8, when processing attacker-controlled data for deserialization, allows Remote Code Execution (RCE) via an unserialized pop chain in __destruct in Illuminate\Broadcasting\PendingBroadcast.php and __call in Faker\Generator.php.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | laravel/laravel | <= 9.1.8 | none recorded |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-vv7q-mfpc-qgm5
- https://nvd.nist.gov/vuln/detail/CVE-2022-31279
- https://github.com/1nhann/vulns/issues/3
- https://github.com/ambionics/phpggc/issues/118
- https://inhann.top/2022/05/17/bypass_wakeup/
- https://github.com/1nhann/vulns/issues/1#issuecomment-1213126338