Security Advisory

CVE-2022-40482

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2023-04-25 00:00:00

Last updated 2025-02-03 20:49:55

Assigner mitre

CVSS score not scored

State PUBLISHED

Description

The authentication method in Laravel 8.x through 9.x before 9.32.0 was discovered to be vulnerable to user enumeration via timeless timing attacks with HTTP/2 multiplexing. This is caused by the early return inside the hasValidCredentials method in the Illuminate\Auth\SessionGuard class when a user is found to not exist.

← Browse all CVEs View on cve.org ↗