{"id":"GHSA-7fjp-g4m7-fx23","aliases":[],"status":"published","title":"User (Encrypted) Password Field Being Serialised","description":"### Impact\nLeaking Password field during serialisation of the User model. Password is in the encrypted form but if User model is requested in json or array form the value is printed.\n\n### Patches\nIssue has been patched in version 0.3.7-beta and onwards.\n\n### Workarounds\nAdd the 'password' field to the Users model file in the hidden array:\n\n```php\n\n    /**\n     * The attributes that should be hidden for arrays.\n     *\n     * @var array\n     */\n    protected $hidden = [\n        'remember_token',\n        'password',\n    ];\n```\n\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [pwweb/laravel-core](https://github.com/pwweb/laravel-core)\n* Email us at [security@pw-websolutions.com](mailto:security@pw-websolutions.com)","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2021-04-13T15:12:26Z","modified":"2024-12-02T05:50:00Z","fixes":[{"ecosystem":"Packagist","package":"pwweb/laravel-core","fixed_in":["0.3.7-beta"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"pwweb/laravel-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.3.6-beta"},{"fixed":"0.3.7-beta"}]}]},{"source":"osv","ecosystem":"Packagist","package":"pwweb/laravel-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.7-beta"}]}],"versions":["0.1.0-beta","0.1.1-beta","0.1.10-beta","0.1.11-beta","0.1.12-beta","0.1.13-beta","0.1.2-beta","0.1.3-beta","0.1.4-beta","0.1.5-beta","0.1.6-beta","0.1.7-beta","0.1.8-beta","0.1.9-beta","0.2.1-beta","0.2.2-beta","0.3.0-beta","0.3.1-beta","0.3.2-beta","0.3.3-beta","0.3.4-beta","0.3.5-beta"]}],"references":[{"url":"https://github.com/pwweb/laravel-core/security/advisories/GHSA-7fjp-g4m7-fx23","tags":["web"]},{"url":"https://github.com/advisories/GHSA-7fjp-g4m7-fx23"}],"sources":{"ghsa":[{"id":"GHSA-7fjp-g4m7-fx23","title":"User (Encrypted) Password Field Being Serialised","description":"### Impact\nLeaking Password field during serialisation of the User model. Password is in the encrypted form but if User model is requested in json or array form the value is printed.\n\n### Patches\nIssue has been patched in version 0.3.7-beta and onwards.\n\n### Workarounds\nAdd the 'password' field to the Users model file in the hidden array:\n\n```php\n\n    /**\n     * The attributes that should be hidden for arrays.\n     *\n     * @var array\n     */\n    protected $hidden = [\n        'remember_token',\n        'password',\n    ];\n```\n\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [pwweb/laravel-core](https://github.com/pwweb/laravel-core)\n* Email us at [security@pw-websolutions.com](mailto:security@pw-websolutions.com)","status":"published","published":"2021-04-13T15:12:26Z","modified":"2023-01-09T05:04:26Z","cwes":["CWE-200"],"updated_at":"2026-11-02T14:36:10.502376Z"}],"osv":[{"id":"GHSA-7fjp-g4m7-fx23","title":"User (Encrypted) Password Field Being Serialised","description":"### Impact\nLeaking Password field during serialisation of the User model. Password is in the encrypted form but if User model is requested in json or array form the value is printed.\n\n### Patches\nIssue has been patched in version 0.3.7-beta and onwards.\n\n### Workarounds\nAdd the 'password' field to the Users model file in the hidden array:\n\n```php\n\n    /**\n     * The attributes that should be hidden for arrays.\n     *\n     * @var array\n     */\n    protected $hidden = [\n        'remember_token',\n        'password',\n    ];\n```\n\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [pwweb/laravel-core](https://github.com/pwweb/laravel-core)\n* Email us at [security@pw-websolutions.com](mailto:security@pw-websolutions.com)","status":"published","published":"2021-04-13T15:12:26Z","modified":"2024-12-02T05:50:00.799843Z","cwes":["CWE-200"],"updated_at":"2026-11-02T15:46:41.002603Z"}]}}