p PatchFirst

GHSA-6pq8-67pw-j6hw

GHSA-6pq8-67pw-j6hw · Time-Based Information Disclosure Vulnerability in Flow

This page contains facts from public vulnerability sources. Check the original advisory before updating.

The PersistedUsernamePasswordProvider was prone to a information disclosure of account existance based on timing attacks as the hashing of passwords was only done in case an account was found. We changed the core so that the provider always does a password comparison in case credentials were submitted at all.

CVSS 5.3 · Medium · Fix available

Published
Updated

Stack: php

Affected products and versions

  • neos/flow Packagist

    Versions
    • 2.3.0
    • 2.3.1
    • 2.3.10
    • 2.3.11
    • 2.3.12
    • 2.3.13
    • 2.3.14
    • 2.3.15
    • 2.3.2
    • 2.3.3
    • 2.3.4
    • 2.3.5
    • 2.3.6
    • 2.3.7
    • 2.3.8
    • 2.3.9
    Affected ranges
    • ECOSYSTEM: ≥ 2.3.0, < 2.3.16

    Update to 2.3.16

  • neos/flow Packagist

    Versions
    • 3.0.0
    • 3.0.1
    • 3.0.2
    • 3.0.3
    • 3.0.4
    • 3.0.5
    • 3.0.6
    • 3.0.7
    • 3.0.8
    • 3.0.9
    Affected ranges
    • ECOSYSTEM: ≥ 3.0.0, < 3.0.10

    Update to 3.0.10

  • neos/flow Packagist

    Versions
    • 3.1.0
    • 3.1.1
    • 3.1.2
    • 3.1.3
    • 3.1.4
    • 3.1.5
    • 3.1.6
    Affected ranges
    • ECOSYSTEM: ≥ 3.1.0, < 3.1.7

    Update to 3.1.7

  • neos/flow Packagist

    Versions
    • 3.2.0
    • 3.2.1
    • 3.2.2
    • 3.2.3
    • 3.2.4
    • 3.2.5
    • 3.2.6
    Affected ranges
    • ECOSYSTEM: ≥ 3.2.0, < 3.2.7

    Update to 3.2.7

  • neos/flow Packagist

    Versions
    • 3.3.0
    • 3.3.1
    • 3.3.2
    • 3.3.3
    • 3.3.4
    Affected ranges
    • ECOSYSTEM: ≥ 3.3.0, < 3.3.5

    Update to 3.3.5

Original sources

Check your server →