CVE-2022-40482

CVSS V2 None CVSS V3 None
Description
The authentication method in Laravel 8.x through 9.x before 9.32.0 was discovered to be vulnerable to user enumeration via timeless timing attacks with HTTP/2 multiplexing. This is caused by the early return inside the hasValidCredentials method in the Illuminate\Auth\SessionGuard class when a user is found to not exist.
Overview
  • CVE ID
  • CVE-2022-40482
  • Assigner
  • cve@mitre.org
  • Vulnerability Status
  • Received
  • Published Version
  • 2023-04-25T19:15:10
  • Last Modified Date
  • 2023-04-25T19:15:10
References
Reference URL Reference Tags
https://ephort.dk/blog/laravel-timing-attack-vulnerability/
https://github.com/ephort/laravel-user-enumeration-demo
https://github.com/laravel/framework/pull/44069
https://github.com/laravel/framework/releases/tag/v9.32.0
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2022-40482
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-40482
History
Created Old Value New Value Data Type Notes
2023-04-25 20:02:34 Added to TrackCVE