CVE-2021-44554

Thinfinity VirtualUI before 3.0 allows a malicious actor to enumerate users registered in the OS (Windows) through the /changePassword URI

published December 20, 2021

CVSS
—
EPSS
1%
Percentile
64.3
In the wild
Unconfirmed
What it is

Thinfinity VirtualUI before 3.0 allows a malicious actor to enumerate users registered in the OS (Windows) through the /changePassword URI. By accessing the vector, an attacker can determine if a username exists thanks to the message returned; it can be presented in different languages according to the configuration of VirtualUI. Common users are administrator, admin, guest and krgtbt.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01063 · 64.3th percentile
Published
2021-12-20T08:31Z
EPSS history
Timeline
  • 20 DEC 08:31Z
    Thinfinity VirtualUI before 3.0 allows a malicious actor to enumerate users registered in the OS (Windows) through the /changePassword URI
    cvelistv5