5.3

CVE-2022-40482

Exploit
The authentication method in Laravel 8.x through 9.x before 9.32.0 was discovered to be vulnerable to user enumeration via timeless timing attacks with HTTP/2 multiplexing. This is caused by the early return inside the hasValidCredentials method in the Illuminate\Auth\SessionGuard class when a user is found to not exist.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Laravel ≫ Framework Version >= 8.0.0 < 8.83.24
Laravel ≫ Framework Version >= 9.0.0 < 9.32.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.88% 0.544
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 5.3 3.9 1.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
134c704f-9b21-4f2e-91b3-4a467353bcc0 5.3 3.9 1.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CWE-203 Observable Discrepancy

The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor.

https://ephort.dk/blog/laravel-timing-attack-vulnerability/
Third Party Advisory
Exploit
Technical Description
https://github.com/ephort/laravel-user-enumeration-demo
Third Party Advisory
Exploit
https://github.com/laravel/framework/pull/44069
Patch
Vendor Advisory
https://github.com/laravel/framework/releases/tag/v9.32.0
Release Notes