Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2022-40482

Date: April 24, 2023

The authentication method in Laravel 8.x through 9.x before 9.32.0 was discovered to be vulnerable to user enumeration via timeless timing attacks with HTTP/2 multiplexing. This is caused by the early return inside the hasValidCredentials method in the Illuminate\Auth\SessionGuard class when a user is found to not exist.

Language: PHP

Severity Score

Related Resources (6)

https://github.com/ephort/laravel-user-enumeration-demo
https://ephort.dk/blog/laravel-timing-attack-vulnerability/
https://github.com/laravel/framework/releases/tag/v9.32.0
https://nvd.nist.gov/vuln/detail/CVE-2022-40482
https://github.com/laravel/framework/pull/44069
https://www.mend.io/vulnerability-database/CVE-2022-40482

Severity Score

Weakness Type (CWE)

Observable Discrepancy

CWE-203

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): LOW
Integrity (I): NONE
Availability (A): NONE

Do you need more information?

Contact Us