Description (CNA)
Scramble generates API documentation for Laravel project. From 0.13.2 to before 0.13.22, when documentation endpoints are publicly accessible and validation rules reference user-controlled input, request supplied data may be evaluated during documentation generation, leading to execution of arbitrary PHP code in the application context. This vulnerability is fixed in 0.13.22.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| dedoc / scramble | affected >= 0.13.2, < 0.13.22 |
CWE
CWE-94
References
- https://github.com/dedoc/scramble/security/advisories/GHSA-4rm2-28vj-fj39
- https://github.com/dedoc/scramble/releases/tag/v0.13.22
ADP enrichment
No English description supplied.
No references supplied.