Remote Authentication Bypass in Laravel 5.4.x by Attackers
CVE-2017-9303

6.1MEDIUM

Key Information:

Vendor

Laravel

Status
Laravel
Vendor
CVE Published:
29 May 2017

What is CVE-2017-9303?

The Laravel Framework version 5.4.x prior to 5.4.22 has a security flaw that fails to adequately restrict the host component of password-reset URLs. This vulnerability allows remote attackers to manipulate the host information, potentially enabling phishing attacks that trick users into providing sensitive information. Properly securing these URLs is essential to prevent unauthorized access and maintain the integrity of user authentication.

References

https://laravel-news.com/laravel-5-4-22-is-now-released-a...
x_refsource_CONFIRM
http://www.securityfocus.com/bid/98776
vdb-entryx_refsource_BID

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2017-9303 : Remote Authentication Bypass in Laravel 5.4.x by Attackers