Filament vulnerabilities

In Filament (full-stack components for Laravel) versions from 4.0.0 until 4.13.3 and 5.8.3, app-based multi-factor authentication (MFA) management actions do not consistently require confirmation of the current password. An attacker with access to an authenticated user session can set up app-based MFA and obtain recovery codes, or disable app-based MFA and regenerate recovery codes by supplying an existing app code or recovery code, without knowing the account password. Email-based MFA is not affected, and the issue does not independently permit an unauthenticated sign-in, but changing the app-MFA configuration may lock the legitimate user out.

Filament (a collection of full-stack components for Laravel) has a vulnerability in Login.php where the MFA challenge is presented before evaluating canAccessPanel(). For an account that canAccessPanel() denies, a correct password renders the MFA challenge while an incorrect password returns a generic authentication failure, allowing an unauthenticated attacker to confirm whether a candidate password is valid.

A vulnerability in Filament (a collection of components for Laravel) in versions from 4.0.0 to 4.12.6 and 5.7.6 allows reuse of a previously issued app-based MFA code even after a newer code has been used, for approximately four minutes, enabling an attacker with the password and one MFA code to access the account.

Filament is a collection of full-stack components for accelerated Laravel development. Prior to versions 4.12.0 and 5.7.0, incorrect challenge-form required-field handling allows app-based multi-factor authentication to be bypassed when recovery codes are enabled. Email-based multi-factor authentication is not affected.

Filament is a collection of components for accelerated Laravel development. From versions 3.0.0 to 3.3.53, a disabled RichEditor field rendered its raw state without sanitizing HTML, allowing attackers to inject malicious HTML or JavaScript, leading to XSS.

In versions 4.0.0 to 4.11.5 and 5.6.5, Filament has a flaw in handling recovery codes for app-based multi-factor authentication that allows the same recovery code to be reused via concurrent submission. This issue does not affect email-based MFA and only applies when recovery codes are enabled.

Filament, a collection of components for accelerated Laravel development, has a vulnerability that allows unauthenticated users to upload files in certain forms, such as the login form. This could lead to unauthorized access to the application's temporary storage.

Filament, a collection of components for accelerated Laravel development, has a vulnerability in the login page from versions 4.0.0 to 4.11.5 and 5.6.5 that allows unauthenticated attackers to enumerate registered email addresses.