Description
Laravel 5.4.x before 5.4.22 does not properly constrain the host portion of a password-reset URL, which makes it easier for remote attackers to conduct phishing attacks by specifying an attacker-controlled host.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | illuminate/auth | >= 5.3.0, <= 5.3.31 | — | GHSA-rc8x-jrrc-frfv |
| Packagist | illuminate/auth | >= 5.4.0, < 5.4.22 | 5.4.22 | GHSA-rc8x-jrrc-frfv |
| Packagist | laravel/framework | >= 5.3.0, <= 5.3.31 | — | GHSA-rc8x-jrrc-frfv |
| Packagist | laravel/framework | >= 5.4.0, < 5.4.22 | 5.4.22 | GHSA-rc8x-jrrc-frfv |
| Packagist | laravel/laravel | >= 5.4.0, < 5.4.22 | 5.4.22 | GHSA-rc8x-jrrc-frfv |