AIKIDO-2024-10208
laravel/framework is vulnerable to Return of Wrong Status Code
10
Low Risk
This Affects:
laravel/frameworkTL;DR
Affected versions of the package are vulnerable to returning the wrong status code when using Bcrypt/Argon/Argon2I hashers. Nullish or empty values are not checked before verifying if a given $hashedValue is compatible with the app's algorithm. A runtime exception is thrown, causing the end user to receive a 500 server error instead of the expected 401/422 or similar authentication failure, which may reveal that the user has not set a password yet.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
laravel/framework is vulnerable to Return of Wrong Status Code in versions 5.7.0 - 11.18.1.
How to fix this
Upgrade the laravel/framework library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant