GHSA-c2v7-j5gq-wcq4

Source

https://github.com/advisories/GHSA-c2v7-j5gq-wcq4

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-c2v7-j5gq-wcq4/GHSA-c2v7-j5gq-wcq4.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-c2v7-j5gq-wcq4

Aliases

CVE-2017-14775

Published

2022-05-17T00:34:22Z

Modified

2024-02-05T10:48:20Z

Severity

5.9 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

Laravel Sensitive Data Exposure

Details

Laravel before 5.5.10 mishandles the remember_me token verification process because DatabaseUserProvider does not have constant-time token comparison.

Database specific

{
    "cwe_ids":  [
        "CWE-200"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2023-07-27T00:46:27Z",
    "nvd_published_at":  "2017-09-28T01:29:00Z",
    "severity":  "MODERATE"
}

References

Affected packages

Packagist / laravel/framework

Package

Name: laravel/framework
Purl: pkg:composer/laravel/framework

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

5.5.10

Affected versions

v4.*

v4.0.0-BETA2

v4.0.0-BETA3

v4.0.0-BETA4

v4.0.0

v4.0.1

v4.0.2

v4.0.3

v4.0.4

v4.0.5

v4.0.6

v4.0.7

v4.0.8

v4.0.9

v4.0.10

v4.0.11

v4.1.0

v4.1.1

v4.1.2

v4.1.3

v4.1.4

v4.1.5

v4.1.6

v4.1.7

v4.1.8

v4.1.9

v4.1.10

v4.1.11

v4.1.12

v4.1.13

v4.1.14

v4.1.15

v4.1.16

v4.1.17

v4.1.18

v4.1.19

v4.1.20

v4.1.21

v4.1.22

v4.1.23

v4.1.24

v4.1.25

v4.1.26

v4.1.27

v4.1.28

v4.1.29

v4.1.30

v4.1.31

v4.2.0-BETA1

v4.2.0

v4.2.1

v4.2.2

v4.2.3

v4.2.4

v4.2.5

v4.2.6

v4.2.7

v4.2.8

v4.2.9

v4.2.10

v4.2.11

v4.2.12

v4.2.13

v4.2.14

v4.2.15

v4.2.16

v4.2.17

v4.2.18

v4.2.19

v4.2.20

v4.2.21

v4.2.22

v5.*

v5.0.0

v5.0.1

v5.0.2

v5.0.3

v5.0.4

v5.0.5

v5.0.6

v5.0.7

v5.0.8

v5.0.9

v5.0.10

v5.0.11

v5.0.12

v5.0.13

v5.0.14

v5.0.15

v5.0.16

v5.0.17

v5.0.18

v5.0.19

v5.0.20

v5.0.21

v5.0.22

v5.0.23

v5.0.24

v5.0.25

v5.0.26

v5.0.27

v5.0.28

v5.0.29

v5.0.31

v5.0.32

v5.0.33

v5.0.34

v5.0.35

v5.1.0

v5.1.1

v5.1.2

v5.1.3

v5.1.4

v5.1.5

v5.1.6

v5.1.7

v5.1.8

v5.1.9

v5.1.10

v5.1.11

v5.1.12

v5.1.13

v5.1.14

v5.1.15

v5.1.16

v5.1.17

v5.1.18

v5.1.19

v5.1.20

v5.1.21

v5.1.22

v5.1.23

v5.1.24

v5.1.25

v5.1.26

v5.1.27

v5.1.28

v5.1.29

v5.1.30

v5.1.31

v5.1.32

v5.1.33

v5.1.34

v5.1.35

v5.1.36

v5.1.37

v5.1.38

v5.1.39

v5.1.40

v5.1.41

v5.1.42

v5.1.43

v5.1.44

v5.1.45

v5.1.46

v5.2.0-beta1

v5.2.0

v5.2.1

v5.2.2

v5.2.3

v5.2.4

v5.2.5

v5.2.6

v5.2.7

v5.2.8

v5.2.9

v5.2.10

v5.2.11

v5.2.12

v5.2.13

v5.2.14

v5.2.15

v5.2.16

v5.2.17

v5.2.18

v5.2.19

v5.2.20

v5.2.21

v5.2.22

v5.2.23

v5.2.24

v5.2.25

v5.2.26

v5.2.27

v5.2.28

v5.2.29

v5.2.30

v5.2.31

v5.2.32

v5.2.33

v5.2.34

v5.2.35

v5.2.36

v5.2.37

v5.2.38

v5.2.39

v5.2.40

v5.2.42

v5.2.43

v5.2.44

v5.2.45

v5.3.0-RC1

v5.3.0

v5.3.1

v5.3.2

v5.3.3

v5.3.4

v5.3.5

v5.3.6

v5.3.7

v5.3.8

v5.3.9

v5.3.10

v5.3.11

v5.3.12

v5.3.13

v5.3.14

v5.3.15

v5.3.16

v5.3.17

v5.3.18

v5.3.19

v5.3.20

v5.3.21

v5.3.22

v5.3.23

v5.3.24

v5.3.25

v5.3.26

v5.3.27

v5.3.28

v5.3.29

v5.3.30

v5.3.31

v5.4.0

v5.4.1

v5.4.2

v5.4.3

v5.4.4

v5.4.5

v5.4.6

v5.4.7

v5.4.8

v5.4.9

v5.4.10

v5.4.11

v5.4.12

v5.4.13

v5.4.14

v5.4.15

v5.4.16

v5.4.17

v5.4.18

v5.4.19

v5.4.20

v5.4.21

v5.4.22

v5.4.23

v5.4.24

v5.4.25

v5.4.26

v5.4.27

v5.4.28

v5.4.29

v5.4.30

v5.4.31

v5.4.32

v5.4.33

v5.4.34

v5.4.35

v5.4.36

v5.5.0

v5.5.1

v5.5.2

v5.5.3

v5.5.4

v5.5.5

v5.5.6

v5.5.7

v5.5.8

v5.5.9

5.*

5.0.30

5.2.41

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-c2v7-j5gq-wcq4/GHSA-c2v7-j5gq-wcq4.json"

Packagist / illuminate/auth