PT-2024-37350 · Unknown · Nasirkhan Laravel Starter

Louay Khammassi · Published 2024-06-17 · Updated 2024-09-23 · CVE-2024-6056

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: nasirkhan Laravel Starter versions up to 11.8.0

Description: A vulnerability was found in the Password Reset Handler component, specifically affecting some unknown functionality of the file /forgot-password. The manipulation of the Email argument leads to observable response discrepancy. The attack can be launched remotely, with a rather high complexity and difficult exploitation. The exploit has been disclosed to the public and may be used.

Recommendations: For nasirkhan Laravel Starter versions up to 11.8.0, consider disabling the Password Reset Handler component or restricting access to the /forgot-password file until a patch is available. As a temporary workaround, avoid using the Email argument in the affected component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Side Channel Attack

Weakness Enumeration

CWE-204

CWE-203

Related Identifiers

CVE-2024-6056

Affected Products

Nasirkhan Laravel Starter

References · 7

• 🔥 https://powerful-bulb-c36.notion.site/idor-c6eb58e8fc40416ba53c7915ca0174c4?pvs=4 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-6056 · Security Note
• https://osv.dev/vulnerability/CVE-2024-6056 · Vendor Advisory
• https://t.me/cvenotify/95669 · Telegram Post
• https://vuldb.com/?id.268784 · Note
• https://vuldb.com/?submit.352978 · Note
• https://vuldb.com/?ctiid.268784 · Note