PT-2024-40448 · Unknown · Persistedusernamepasswordprovider

Published 2024-06-05 · Updated 2024-06-05

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions PersistedUsernamePasswordProvider (affected versions not specified)

Description The issue concerns a timing attack that could disclose the existence of accounts based on the hashing of passwords. This occurred because password hashing was only performed when an account was found. The core has been modified so that the provider always performs a password comparison when credentials are submitted.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

GHSA-R6MM-WMHF-849M

Affected Products

Persistedusernamepasswordprovider

References · 4

• https://osv.dev/vulnerability/GHSA-r6mm-wmhf-849m · Vendor Advisory
• https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/flow/2016-11-01.yaml · Note
• https://github.com/neos/flow · Note
• https://neos.io/blog/flow-sa-2016-001.html · Note