CVE-2020-24940
Guard bypass in Eloquent models affecting Laravel illuminate database component
An issue was discovered in Laravel before 6.18.34 and 7.x before 7.23.2. Unvalidated values are saved to the database in some situations in which table names are stripped during a mass assignment.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
An issue was discovered in Laravel before 6.18.34 and 7.x before 7.23.2. Unvalidated values are saved to the database in some situations in which table names are stripped during a mass assignment.
- Record
CVE-2020-24940- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
An issue was discovered in Laravel before 6.18.34 and 7.x before 7.23.2. Unvalidated values are saved to the database in some situations in which table names are stripped during a mass assignment.
- Record
CVE-2020-24940- Updated
- 2026-11-02
EUVDEUVD-2022-3530 No score
An issue was discovered in Laravel before 6.18.34 and 7.x before 7.23.2. Unvalidated values are saved to the database in some situations in which table names are stripped during a mass assignment.
- Record
EUVD-2022-3530- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-c7rm-w2hj-x8g3
Guard bypass in Eloquent models affecting Laravel illuminate database component
An issue was discovered in Laravel before 6.18.34 and 7.x before 7.23.2. Unvalidated values are saved to the database component in some situations in which table names are stripped during a mass assignment.
- Record
GHSA-c7rm-w2hj-x8g3- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSV
An issue was discovered in Laravel before 6.18.34 and 7.x before 7.23.2. Unvalidated values are saved to the database in some situations in which table names are stripped during a mass assignment.
- Record
CVE-2020-24940- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVGHSA-c7rm-w2hj-x8g3
Guard bypass in Eloquent models affecting Laravel illuminate database component
An issue was discovered in Laravel before 6.18.34 and 7.x before 7.23.2. Unvalidated values are saved to the database component in some situations in which table names are stripped during a mass assignment.
- Record
GHSA-c7rm-w2hj-x8g3- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVBIT-laravel-2020-24940 No score
An issue was discovered in Laravel before 6.18.34 and 7.x before 7.23.2. Unvalidated values are saved to the database in some situations in which table names are stripped during a mass assignment.
- Record
BIT-laravel-2020-24940- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
illuminate/databasePackagist |
5.5.0 to 5.5.44 | None known |
illuminate/databasePackagist |
6.0.0 up to 6.18.34 | 6.18.34 |
illuminate/databasePackagist |
7.0.0 up to 7.23.2 | 7.23.2 |
laravelBitnami |
before 6.18.34, 7.0.0 up to 7.23.2 | 6.18.347.23.2 |
illuminate/databasePackagist |
5.5.0 to 5.5.44, plus listed versions v5.5.0v5.5.16v5.5.17v5.5.2v5.5.28 Show 10 moreShow lessv5.5.33v5.5.34v5.5.35v5.5.36v5.5.37v5.5.39v5.5.40v5.5.41v5.5.43v5.5.44 |
None known |
illuminate/databasePackagist |
6.0.0 up to 6.18.34, plus listed versions v6.0.0v6.0.1v6.0.2v6.0.3v6.0.4 Show 45 moreShow lessv6.1.0v6.10.0v6.11.0v6.12.0v6.13.0v6.13.1v6.14.0v6.15.0v6.15.1v6.16.0v6.17.0v6.17.1v6.18.0v6.18.1v6.18.10v6.18.11v6.18.12v6.18.13v6.18.14v6.18.15v6.18.16v6.18.17v6.18.18v6.18.19v6.18.2v6.18.20v6.18.21v6.18.22v6.18.23v6.18.24v6.18.25v6.18.26v6.18.27v6.18.28v6.18.29v6.18.3v6.18.30v6.18.31v6.18.32v6.18.33v6.18.4v6.18.5v6.18.6v6.18.7v6.18.8 |
6.18.34 |
illuminate/databasePackagist |
7.0.0 up to 7.23.2, plus listed versions v7.0.0v7.0.1v7.0.2v7.0.3v7.0.4 Show 45 moreShow lessv7.0.5v7.0.6v7.0.7v7.0.8v7.1.0v7.1.1v7.1.2v7.1.3v7.10.0v7.10.1v7.10.2v7.10.3v7.11.0v7.12.0v7.13.0v7.14.0v7.14.1v7.15.0v7.16.0v7.16.1v7.17.0v7.17.1v7.17.2v7.18.0v7.19.0v7.19.1v7.2.0v7.2.1v7.2.2v7.20.0v7.21.0v7.22.0v7.22.1v7.22.2v7.22.3v7.22.4v7.23.0v7.23.1v7.3.0v7.4.0v7.5.0v7.5.1v7.5.2v7.6.0v7.6.1 |
7.23.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-24940 is a high vulnerability (CVSS 7.5) in Laravel, published September 4, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.20%, the 68th percentile. Fixed in illuminate/database 6.18.34.
References
Left out here: 20 versions. The JSON record has them.