Severity
- CVSS 3.x
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected versions
Repository
| Affected commits | Fixed by commit |
|---|---|
| GIT github.com/laravel/framework ↗ | |
| All commits through a0fdfd2c90318c107b6a8d69189ec9a6607379e3 | No fix listed |
| Not specified | 6c63130c001bd0b2bec30d330e110be63b5caee6 |
Also listed as affected (14)
| |
Description
Laravel before 5.5.10 mishandles the remember_me token verification process because DatabaseUserProvider does not have constant-time token comparison.