VulnerabilityAnalyzed
CVE-2022-40482
The authentication method in Laravel 8.x through 9.x before 9.32.0 was discovered to be vulnerable to user enumeration via timeless timing attacks with HTTP/2 multiplexing.
MEDIUM 5.3EPSS 0.88%
Does this matter?
Lower severity and a low EPSS score (0.88%). Track it; it rarely justifies an emergency change on its own.
Description
The authentication method in Laravel 8.x through 9.x before 9.32.0 was discovered to be vulnerable to user enumeration via timeless timing attacks with HTTP/2 multiplexing. This is caused by the early return inside the hasValidCredentials method in the Illuminate\Auth\SessionGuard class when a user is found to not exist.
- CVSS 3.1
- 5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- EPSS
- 0.88% probability · 57th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-203
- Affected
- laravel/framework
- Source
- cve@mitre.org
References
- https://ephort.dk/blog/laravel-timing-attack-vulnerability/Exploit, Technical Description, Third Party Advisory
- https://github.com/ephort/laravel-user-enumeration-demoExploit, Third Party Advisory
- https://github.com/laravel/framework/pull/44069Patch, Vendor Advisory
- https://github.com/laravel/framework/releases/tag/v9.32.0Release Notes
- https://ephort.dk/blog/laravel-timing-attack-vulnerability/Exploit, Technical Description, Third Party Advisory
- https://github.com/ephort/laravel-user-enumeration-demoExploit, Third Party Advisory
- https://github.com/laravel/framework/pull/44069Patch, Vendor Advisory
- https://github.com/laravel/framework/releases/tag/v9.32.0Release Notes
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.