Description
Statamic CMS's user-augmentation resolver, AugmentedUser::get in src/Auth/AugmentedUser.php, contains an explicit case for the handle that returns the user's raw two-factor recovery codes with no access restriction.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| statamic | cms | ≤ 6.23.0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | statamic/cms | >= 6.0.0-alpha.1, <= 6.30.0 | — | GHSA-jppw-r5j3-xf7x |
References
- https://github.com/statamic/cms third-party-advisory
- https://github.com/statamic/cms/blob/master/src/Auth/AugmentedUser.php third-party-advisory