{"id":"GHSA-7fjp-g4m7-fx23","summary":"User (Encrypted) Password Field Being Serialised","details":"### Impact\nLeaking Password field during serialisation of the User model. Password is in the encrypted form but if User model is requested in json or array form the value is printed.\n\n### Patches\nIssue has been patched in version 0.3.7-beta and onwards.\n\n### Workarounds\nAdd the 'password' field to the Users model file in the hidden array:\n\n```php\n\n    /**\n     * The attributes that should be hidden for arrays.\n     *\n     * @var array\n     */\n    protected $hidden = [\n        'remember_token',\n        'password',\n    ];\n```\n\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [pwweb/laravel-core](https://github.com/pwweb/laravel-core)\n* Email us at [security@pw-websolutions.com](mailto:security@pw-websolutions.com)","modified":"2024-12-02T05:50:00.799843Z","published":"2021-04-13T15:12:26Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2021-04-12T20:05:57Z","nvd_published_at":null,"cwe_ids":["CWE-200"],"severity":"LOW"},"references":[{"type":"WEB","url":"https://github.com/pwweb/laravel-core/security/advisories/GHSA-7fjp-g4m7-fx23"}],"affected":[{"package":{"name":"pwweb/laravel-core","ecosystem":"Packagist","purl":"pkg:composer/pwweb/laravel-core"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.7-beta"}]}],"versions":["0.1.0-beta","0.1.1-beta","0.1.10-beta","0.1.11-beta","0.1.12-beta","0.1.13-beta","0.1.2-beta","0.1.3-beta","0.1.4-beta","0.1.5-beta","0.1.6-beta","0.1.7-beta","0.1.8-beta","0.1.9-beta","0.2.1-beta","0.2.2-beta","0.3.0-beta","0.3.1-beta","0.3.2-beta","0.3.3-beta","0.3.4-beta","0.3.5-beta"],"database_specific":{"last_known_affected_version_range":"\u003c= 0.3.6-beta","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/04/GHSA-7fjp-g4m7-fx23/GHSA-7fjp-g4m7-fx23.json"}}],"schema_version":"1.9.0"}