UpHeron
All vulnerabilities

Servers and applications

CVE-2022-24784

Discoverability of user password hash via REST API

Severity
Low 3.7
Published
25 Mar 2022
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
3.2.39, 3.3.2
Also known as
GHSA-qcgx-7p5f-hxvr
Sources
NVD, Project advisories (GitHub)

Description

Statamic is a Laravel and Git powered CMS. Before versions 3.2.39 and 3.3.2, it is possible to confirm a single character of a user's password hash using a specially crafted regular expression filter in the users endpoint of the REST API. Multiple such requests can eventually uncover the entire hash. The hash is not present in the response, however the presence or absence of a result confirms if…

Affected software

SoftwareAffected versions
StatamicServers and applications · cpe:a:statamic:statamic
  • Every version before 3.2.39
  • From 3.3.0 before 3.3.2
StatamicServers and applications · github:statamic/cms
  • Every version before 3.2.39

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2022-24784
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2022-24784
  • GitHub Advisory Database https://github.com/advisories/GHSA-qcgx-7p5f-hxvr
  • github.com https://github.com/statamic/cms/security/advisories/GHSA-qcgx-7p5f-hxvr