Skip to content
Fencer Intel
low —

GHSA-2frx-j9hj-6c65 json

User enumeration in authentication mechanisms

published 5y ago modified last yr.

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
—
no score, EPSS covers CVEs only
public exploits
0
none known

Summary

Description -----------

The ability to enumerate users was possible without relevant permissions due to different exception messages depending on whether the user existed or not.

Resolution ----------

We now ensure that a generic message is returned whether the user exists or not if the password is invalid or if the user does not exist.

The patch for this issue is available [here](https://github.com/lexik/LexikJWTAuthenticationBundle/commit/a175d6dab968d93e96a3e4f80c495435f71d5eb7) for branch 2.10.x and 2.x.

Credits -------

I would like to thank James Isaac and Mathias Brodala for reporting the issue and Robin Chalas for fixing the issue.

Patch / fix

  • packagist lexik/jwt-authentication-bundle 2.10.7, 2.11.3

Is GHSA-2frx-j9hj-6c65 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem package affected fixed in
packagist lexik/jwt-authentication-bundle
<2.10.7
>=2.11.0, <2.11.3
2.10.7
2.11.3

Classification

Weakness
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.