CVE-2022-40482
published 2023-04-25CVE-2022-40482: The authentication method in Laravel 8.x through 9.x before 9.32.0 was discovered to be vulnerable to user enumeration via timeless timing attacks with HTTP/2…
PriorityP427medium5.3CVSS 3.1
AVNACLPRNUINSUCLINAN
EPSS
0.88%
54.6th percentile
The authentication method in Laravel 8.x through 9.x before 9.32.0 was discovered to be vulnerable to user enumeration via timeless timing attacks with HTTP/2 multiplexing. This is caused by the early return inside the hasValidCredentials method in the Illuminate\Auth\SessionGuard class when a user is found to not exist.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| laravel | framework | >= 8.0.0 < 8.83.24 | 8.83.24 |
| laravel | framework | >= 9.0.0 < 9.32.0 | 9.32.0 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://ephort.dk/blog/laravel-timing-attack-vulnerability/https://github.com/ephort/laravel-user-enumeration-demohttps://github.com/laravel/framework/pull/44069https://github.com/laravel/framework/releases/tag/v9.32.0https://ephort.dk/blog/laravel-timing-attack-vulnerability/https://github.com/ephort/laravel-user-enumeration-demohttps://github.com/laravel/framework/pull/44069https://github.com/laravel/framework/releases/tag/v9.32.0
2023-04-25
Published