GHSA-2frx-j9hj-6c65
GHSA-2frx-j9hj-6c65 · User enumeration in authentication mechanisms
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Description ----------- The ability to enumerate users was possible without relevant permissions due to different exception messages depending on whether the user existed or not. Resolution ---------- We now ensure that a generic message is returned whether the user exists or not if the password is invalid or if the user does not exist. The patch for this issue is available [here](https://github.com/lexik/LexikJWTAuthenticationBundle/commit/a175d6dab968d93e96a3e4f80c495435f71d5eb7) for branch 2.10.x and 2.x. Credits ------- I would like to thank James Isaac and Mathias Brodala for reporting the issue and Robin Chalas for fixing the issue.
Fix available
- Published
- Updated
Stack: php
Affected products and versions
lexik/jwt-authentication-bundle Packagist
- Versions
- 1.6.0
- v1.0.0
- v1.0.1
- v1.0.10
- v1.0.2
- v1.0.3
- v1.0.4
- v1.0.5
- v1.0.6
- v1.0.7
- v1.0.8
- v1.0.9
- v1.1.0
- v1.2.0
- v1.3.0
- v1.3.1
- v1.4.0
- v1.4.1
- v1.4.2
- v1.4.3
- v1.5.0
- v1.5.1
- v1.7.0
- v1.7.1
- v2.0.0
- v2.0.1
- v2.0.2
- v2.0.3
- v2.1.0
- v2.1.1
- v2.10.0
- v2.10.1
- v2.10.2
- v2.10.3
- v2.10.4
- v2.10.5
- v2.10.6
- v2.2.0
- v2.3.0
- v2.4.0
- v2.4.1
- v2.4.2
- v2.4.3
- v2.4.4
- v2.5.0
- v2.5.1
- v2.5.2
- v2.5.3
- v2.5.4
- v2.6.0
- v2.6.1
- v2.6.2
- v2.6.3
- v2.6.4
- v2.6.5
- v2.7.0
- v2.8.0
- v2.9.0
- Affected ranges
- ECOSYSTEM: < 2.10.7
Update to 2.10.7
lexik/jwt-authentication-bundle Packagist
- Versions
- v2.11.0
- v2.11.1
- v2.11.2
- Affected ranges
- ECOSYSTEM: ≥ 2.11.0, < 2.11.3
Update to 2.11.3