AIKIDO-2024-10208
laravel/framework is vulnerable to Return of Wrong Status Code
10
Low Risk
This Affects:
laravel/frameworkTL;DR
Affected versions of the package are vulnerable to returning the wrong status code when using Bcrypt/Argon/Argon2I hashers. Nullish or empty values are not checked before verifying if a given $hashedValue is compatible with the app's algorithm. A runtime exception is thrown, causing the end user to receive a 500 server error instead of the expected 401/422 or similar authentication failure, which may reveal that the user has not set a password yet.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
laravel/framework is vulnerable to Return of Wrong Status Code in versions 5.7.0 - 11.18.1.
How to fix this
Upgrade the laravel/framework library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.