CVE-2017-14775

Laravel before 5.5.10 mishandles the remember_me token verification process because DatabaseUserProvider does not have constant-time token comparison.

Score

CVSS 3.0 5.9 Medium

Status

Modified - cve@mitre.org

Published

2017-09-28

Last modified

2024-09-17

Weaknesses

CWE-200

Affected products

• Laravel (Laravel)

References

• https://github.com/laravel/framework/pull/21320
• https://github.com/laravel/framework/releases/tag/v5.5.10
• https://laravel-news.com/laravel-v5-5-11