CVE-2021-21979

In Bitnami Containers, all Laravel container versions prior to: 6.20.0-debian-10-r107 for Laravel 6, 7.30.1-debian-10-r108 for Laravel 7 and 8.5.11-debian-10-r0 for Laravel 8, the file /tmp/app/.env is generated at the time that the docker image bitnami/laravel was built, and the value of APP_KEY is fixed under certain conditions. This value is crucial for the security of the application and must be randomly generated per Laravel installation. If your application's encryption key is in the hands of a malicious party, that party could craft cookie values using the encryption key and exploit vulnerabilities inherent to PHP object serialization / unserialization, such as calling arbitrary class methods within your application.

• CWE-798

• https://github.com/bitnami/bitnami-docker-laravel/issues/139Exploit, Third Party Advisory
• https://github.com/bitnami/bitnami-docker-laravel/issues/139Exploit, Third Party Advisory

Published

Mar 3, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-21972The vSphere Client (HTML5) contains a remote code execution …9.8
• CVE-2021-21973The vSphere Client (HTML5) contains an SSRF (Server Side Req…5.3
• CVE-2021-21974OpenSLP as used in ESXi (7.0 before ESXi70U1c-17325551, 6.7 …8.8
• CVE-2021-21975Server Side Request Forgery in vRealize Operations Manager A…7.5
• CVE-2021-21976vSphere Replication 8.3.x prior to 8.3.1.2, 8.2.x prior to 8…7.2
• CVE-2021-21978VMware View Planner 4.x prior to 4.6 Security Patch 1 contai…9.8
• CVE-2021-2198Vulnerability in the Oracle Knowledge Management product of …8.2
• CVE-2021-21980The vSphere Web Client (FLEX/Flash) contains an unauthorized…7.5
• CVE-2021-21981VMware NSX-T contains a privilege escalation vulnerability d…7.8
• CVE-2021-21982VMware Carbon Black Cloud Workload appliance 1.0.0 and 1.01 …9.1
• CVE-2021-21983Arbitrary file write vulnerability in vRealize Operations Ma…6.5
• CVE-2021-21984VMware vRealize Business for Cloud 7.x prior to 7.6.0 contai…9.8