medium5.9
CVE-2017-14775
Laravel before 5.5.10 mishandles the remember_me token verification process because DatabaseUserProvider does not have constant-time token comparison.
Impact
Laravel before 5.5.10 mishandles the remember_me token verification process because DatabaseUserProvider does not have constant-time token comparison.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Laravel | Laravel | through 5.5.9 |
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/laravel/framework/pull/21320
- https://github.com/laravel/framework/releases/tag/v5.5.10
- https://laravel-news.com/laravel-v5-5-11
- https://github.com/laravel/framework/pull/21320
- https://github.com/laravel/framework/releases/tag/v5.5.10
- https://laravel-news.com/laravel-v5-5-11