{"id":"GHSA-7fjp-g4m7-fx23","aliases":[],"title":"User (Encrypted) Password Field Being Serialised","titleSource":"OSV","descriptionSource":"OSV","declaredSeverity":"LOW","description":"### Impact\nLeaking Password field during serialisation of the User model. Password is in the encrypted form but if User model is requested in json or array form the value is printed.\n\n### Patches\nIssue has been patched in version 0.3.7-beta and onwards.\n\n### Workarounds\nAdd the 'password' field to the Users model file in the hidden array:\n\n```php\n\n    /**\n     * The attributes that should be hidden for arrays.\n     *\n     * @var array\n     */\n    protected $hidden = [\n        'remember_token',\n        'password',\n    ];\n```\n\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [pwweb/laravel-core](https://github.com/pwweb/laravel-core)\n* Email us at [security@pw-websolutions.com](mailto:security@pw-websolutions.com)","severity":"low","score":null,"published":"2021-04-13T15:12:26.000Z","modified":"2024-12-02T05:50:00.799Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"pwweb/laravel-core","sources":[{"name":"OSV · GHSA-7fjp-g4m7-fx23","url":"https://osv.dev/vulnerability/GHSA-7fjp-g4m7-fx23"}],"ranges":[{"events":[{"introduced":"0"},{"fixed":"0.3.7-beta"}],"type":"ECOSYSTEM"}],"versions":["0.1.0-beta","0.1.1-beta","0.1.10-beta","0.1.11-beta","0.1.12-beta","0.1.13-beta","0.1.2-beta","0.1.3-beta","0.1.4-beta","0.1.5-beta","0.1.6-beta","0.1.7-beta","0.1.8-beta","0.1.9-beta","0.2.1-beta","0.2.2-beta","0.3.0-beta","0.3.1-beta","0.3.2-beta","0.3.3-beta","0.3.4-beta","0.3.5-beta"],"fixed":["0.3.7-beta"]}],"sourceAffected":[],"references":["https://github.com/pwweb/laravel-core/security/advisories/GHSA-7fjp-g4m7-fx23"],"sources":[{"name":"OSV","id":"GHSA-7fjp-g4m7-fx23","modified":"2024-12-02T05:50:00.799843Z","url":"https://osv.dev/vulnerability/GHSA-7fjp-g4m7-fx23"}],"assessments":[],"products":[],"remediation":[],"kev":{"status":"unavailable","checkedAt":"2026-10-28T19:15:31.108Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}