Detections
Analytics

SCA: security update for laravel/pulse (GHSA-8vwh-pr89-4mw2)

high Tenable Self-Hosted Container Security Plugin ID 412880

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Laravel Pulse is a real-time application performance monitoring tool and dashboard for Laravel
 applications. A vulnerability has been discovered in Laravel Pulse prior to version 1.3.1 that could allow
 remote code execution through the public `remember()` method in the
 `Laravel\Pulse\Livewire\Concerns\RemembersQueries` trait. This method is accessible via Livewire
 components and can be exploited to call arbitrary callables within the application. An authenticated user
 with access to Laravel Pulse dashboard can execute arbitrary code by calling any function or static method
 in which the callable is a function or static method and the callable has no parameters or no strict
 parameter types. The vulnerable to component is `remember(callable $query, string $key = '')` method in
 `Laravel\Pulse\Livewire\Concerns\RemembersQueries`, and the vulnerability affects all Pulse card
 components that use this trait. Version 1.3.1 contains a patch. (CVE-2024-55661)

See Also

https://github.com/advisories/GHSA-8vwh-pr89-4mw2

Plugin Details

Severity: High

ID: 412880

Version: Revision 1.17

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/20/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 6.9

Percentile: 96.89

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.9

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2024-55661

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 7.9

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 8.7

Threat Score: 7.4

Threat Vector: CVSS:4.0/E:P

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 12/13/2024

Vulnerability Publication Date: 12/13/2024

Reference Information

CVE: CVE-2024-55661

cwe: CWE-94