PT-2022-17561 · Laravel · Laravel Fortify

Published 2022-02-24 · Updated 2022-03-08 · CVE-2022-25838

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Laravel Fortify versions prior to 1.11.1

Description The issue allows reuse within a short time window, which compromises the one-time nature of the Time-Based One-Time Password (TOTP) concept.

Recommendations For versions prior to 1.11.1, update to version 1.11.1 or later to resolve the issue.

Exploit

Fix

Weakness Enumeration

CWE-294

Related Identifiers

CVE-2022-25838

GHSA-6W4V-QR4M-97GG

Affected Products

Laravel Fortify

References · 11

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/laravel/fortify/CVE-2022-25838.yaml · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-25838 · Security Note
• https://osv.dev/vulnerability/CVE-2022-25838 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6w4v-qr4m-97gg · Vendor Advisory
• https://github.com/laravel/fortify/issues/201#issuecomment-1009282153 · Note
• https://github.com/laravel/fortify · Note
• https://github.com/laravel/fortify/pull/358 · Note
• https://github.com/laravel/fortify/issues/201 · Note
• https://github.com/laravel/fortify/pull/357 · Note
• https://github.com/advisories/GHSA-6w4v-qr4m-97gg · Note
• https://t.me/cibsecurity/38027 · Telegram Post