Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:composer/illuminate/auth@5.4.36
Typecomposer
Namespaceilluminate
Nameauth
Version5.4.36
Qualifiers
Subpath
Is_vulnerabletrue
Next_non_vulnerable_version5.5.40
Latest_non_vulnerable_version5.6.15
Affected_by_vulnerabilities
0
url VCID-eqzu-3cmt-2ube
vulnerability_id VCID-eqzu-3cmt-2ube
summary 
Close remember_me Timing Attack Vector
This package mishandles the `remember_me token` verification process because `DatabaseUserProvider` does not have constant-time token comparison.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2017-14775
reference_id
reference_type
scores
0
value 0.00289
scoring_system epss
scoring_elements 0.52673
published_at 2026-06-06T12:55:00Z
1
value 0.00289
scoring_system epss
scoring_elements 0.52666
published_at 2026-06-05T12:55:00Z
2
value 0.00289
scoring_system epss
scoring_elements 0.52607
published_at 2026-06-04T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2017-14775
1
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/illuminate/auth/CVE-2017-14775.yaml
reference_id
reference_type
scores
0
value 5.9
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/illuminate/auth/CVE-2017-14775.yaml
2
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/laravel/framework/CVE-2017-14775.yaml
reference_id
reference_type
scores
0
value 5.9
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/laravel/framework/CVE-2017-14775.yaml
3
reference_url https://github.com/laravel/framework/pull/21320
reference_id
reference_type
scores
0
value 5.9
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/laravel/framework/pull/21320
4
reference_url https://github.com/laravel/framework/releases/tag/v5.5.10
reference_id
reference_type
scores
0
value 5.9
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/laravel/framework/releases/tag/v5.5.10
5
reference_url https://laravel-news.com/laravel-v5-5-11
reference_id
reference_type
scores
0
value 5.9
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://laravel-news.com/laravel-v5-5-11
6
reference_url https://nvd.nist.gov/vuln/detail/CVE-2017-14775
reference_id
reference_type
scores
0
value 5.9
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2017-14775
fixed_packages
0
url pkg:composer/illuminate/auth@5.5.10
purl pkg:composer/illuminate/auth@5.5.10
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/illuminate/auth@5.5.10
1
url pkg:composer/illuminate/auth@5.5.15
purl pkg:composer/illuminate/auth@5.5.15
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-yuwm-88g2-jke5
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/illuminate/auth@5.5.15
aliases CVE-2017-14775, GHSA-c2v7-j5gq-wcq4
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-eqzu-3cmt-2ube
1
url VCID-yuwm-88g2-jke5
vulnerability_id VCID-yuwm-88g2-jke5
summary 
Unsafe payload decryption
There's a potential exploit of the Laravel Encrypter component that may cause the Encrypter to fail on decryption and unexpectedly return false. To exploit this, the attacker must be able to modify the encrypted payload before it is decrypted. This could lead to unexpected behavior when combined with weak type comparisons.
references
0
reference_url https://medium.com/@taylorotwell/laravel-security-release-5-6-15-and-5-5-40-56f1257933a0
reference_id
reference_type
scores
url https://medium.com/@taylorotwell/laravel-security-release-5-6-15-and-5-5-40-56f1257933a0
fixed_packages
0
url pkg:composer/illuminate/auth@5.5.40
purl pkg:composer/illuminate/auth@5.5.40
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/illuminate/auth@5.5.40
1
url pkg:composer/illuminate/auth@5.6.15
purl pkg:composer/illuminate/auth@5.6.15
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/illuminate/auth@5.6.15
aliases GMS-2018-28
risk_score null
exploitability 0.5
weighted_severity 0.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-yuwm-88g2-jke5
Fixing_vulnerabilities
Risk_score3.1
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:composer/illuminate/auth@5.4.36