CVE-2025-48490

Laravel Rest Api is an API generator. Prior to version 2.13.0, a validation bypass vulnerability was discovered where multiple validations defined for the same attribute could be silently overridden. Due to how the framework merged validation rules across multiple contexts (such as index, store, and update actions), malicious actors could exploit this behavior by crafting requests that bypass expected validation rules, potentially injecting unexpected or dangerous parameters into the application. This could lead to unauthorized data being accepted or processed by the API, depending on the context in which the validation was bypassed. This issue has been patched in version 2.13.0.

CVSS

No CVSS.

References

Link	Resource
https://github.com/Lomkit/laravel-rest-api/commit/88b14587b4efd7e59d7379658c606d325bb513b4
https://github.com/Lomkit/laravel-rest-api/pull/172
https://github.com/Lomkit/laravel-rest-api/security/advisories/GHSA-69rh-hccr-cxrj

Configurations

No configuration.

History

30 May 2025, 16:31

Type	Values Removed	Values Added
Summary		(es) Laravel Rest API es un generador de API. Antes de la versión 2.13.0, se descubrió una vulnerabilidad de omisión de validación que permitía anular silenciosamente múltiples validaciones definidas para el mismo atributo. Debido a la forma en que el framework fusionaba las reglas de validación en múltiples contextos (como acciones de indexar, almacenar y actualizar), actores maliciosos podían explotar este comportamiento creando solicitudes que omiten las reglas de validación esperadas, lo que podría inyectar parámetros inesperados o peligrosos en la aplicación. Esto podría provocar que la API aceptara o procesara datos no autorizados, según el contexto en el que se omitiera la validación. Este problema se ha corregido en la versión 2.13.0.

30 May 2025, 06:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-05-30 06:15

Updated : 2025-05-30 16:31

NVD link : CVE-2025-48490

Mitre link : CVE-2025-48490

CVE.ORG link : CVE-2025-48490

JSON object : View

Products Affected

No product.

CWE

CWE-20

Improper Input Validation

CWE-1173

Improper Use of Validation Framework

{"id": "CVE-2025-48490", "cveTags": [], "metrics": {"cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.6, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "UNREPORTED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2025-05-30T06:15:28.117", "references": [{"url": "https://github.com/Lomkit/laravel-rest-api/commit/88b14587b4efd7e59d7379658c606d325bb513b4", "source": "security-advisories@github.com"}, {"url": "https://github.com/Lomkit/laravel-rest-api/pull/172", "source": "security-advisories@github.com"}, {"url": "https://github.com/Lomkit/laravel-rest-api/security/advisories/GHSA-69rh-hccr-cxrj", "source": "security-advisories@github.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "CWE-1173"}]}], "descriptions": [{"lang": "en", "value": "Laravel Rest Api is an API generator. Prior to version 2.13.0, a validation bypass vulnerability was discovered where multiple validations defined for the same attribute could be silently overridden. Due to how the framework merged validation rules across multiple contexts (such as index, store, and update actions), malicious actors could exploit this behavior by crafting requests that bypass expected validation rules, potentially injecting unexpected or dangerous parameters into the application. This could lead to unauthorized data being accepted or processed by the API, depending on the context in which the validation was bypassed. This issue has been patched in version 2.13.0."}, {"lang": "es", "value": "Laravel Rest API es un generador de API. Antes de la versi\u00f3n 2.13.0, se descubri\u00f3 una vulnerabilidad de omisi\u00f3n de validaci\u00f3n que permit\u00eda anular silenciosamente m\u00faltiples validaciones definidas para el mismo atributo. Debido a la forma en que el framework fusionaba las reglas de validaci\u00f3n en m\u00faltiples contextos (como acciones de indexar, almacenar y actualizar), actores maliciosos pod\u00edan explotar este comportamiento creando solicitudes que omiten las reglas de validaci\u00f3n esperadas, lo que podr\u00eda inyectar par\u00e1metros inesperados o peligrosos en la aplicaci\u00f3n. Esto podr\u00eda provocar que la API aceptara o procesara datos no autorizados, seg\u00fan el contexto en el que se omitiera la validaci\u00f3n. Este problema se ha corregido en la versi\u00f3n 2.13.0."}], "lastModified": "2025-05-30T16:31:03.107", "sourceIdentifier": "security-advisories@github.com"}