{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.3.6-beta"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "pwweb/laravel-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.3.7-beta"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-200"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-04-12T20:05:57Z",
    "nvd_published_at": null,
    "severity": "LOW"
  },
  "details": "### Impact\nLeaking Password field during serialisation of the User model. Password is in the encrypted form but if User model is requested in json or array form the value is printed.\n\n### Patches\nIssue has been patched in version 0.3.7-beta and onwards.\n\n### Workarounds\nAdd the \u0027password\u0027 field to the Users model file in the hidden array:\n\n```php\n\n    /**\n     * The attributes that should be hidden for arrays.\n     *\n     * @var array\n     */\n    protected $hidden = [\n        \u0027remember_token\u0027,\n        \u0027password\u0027,\n    ];\n```\n\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [pwweb/laravel-core](https://github.com/pwweb/laravel-core)\n* Email us at [security@pw-websolutions.com](mailto:security@pw-websolutions.com)",
  "id": "GHSA-7fjp-g4m7-fx23",
  "modified": "2021-04-12T20:05:57Z",
  "published": "2021-04-13T15:12:26Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/pwweb/laravel-core/security/advisories/GHSA-7fjp-g4m7-fx23"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [],
  "summary": "User (Encrypted) Password Field Being Serialised"
}