orchestra/testbench-v6.24.1: 1 vulnerabilities (highest severity is: 9.8)

[mend-for-github-com]

Vulnerable Library - orchestra/testbench-v6.24.1

Found in HEAD commit: d688055c8cf8d3dd40a25f06d595fd6028a50be8

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in	Remediation Available
CVE-2022-30778	High	9.8	laravel/framework-v8.83.22	Transitive	N/A	❌

Details

CVE-2022-30778

Vulnerable Library - laravel/framework-v8.83.22

The Laravel Framework.

Library home page: https://api.github.com/repos/laravel/framework/zipball/96aecced5126d48e277e5339193c376fe82b6565

Dependency Hierarchy:

• orchestra/testbench-v6.24.1 (Root Library)
  • ❌ laravel/framework-v8.83.22 (Vulnerable Library)

Found in HEAD commit: d688055c8cf8d3dd40a25f06d595fd6028a50be8

Found in base branch: main

Vulnerability Details

Laravel 9.1.8, when processing attacker-controlled data for deserialization, allows Remote Code Execution via an unserialize pop chain in __destruct in Illuminate\Broadcasting\PendingBroadcast.php and dispatch($command) in Illuminate\Bus\QueueingDispatcher.php.

Publish Date: 2022-05-16

URL: CVE-2022-30778

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

[SecondeJK]

Note: if Laravel v.8 itself is vulnerable then we can't do anything about that. This library is specifically a package -for- Laravel.