CVE-2022-23172

Priority - Priority User Enumeration

Medium · published July 6, 2022

CVSS v3.1
5.5
EPSS
0%
Percentile
37.3
In the wild
Unconfirmed
What it is

An attacker can access to "Forgot my password" button, as soon as he puts users is valid in the system, the system would issue a message that a password reset email had been sent to user. This way you can verify which users are in the system and which are not.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00441 · 37.3th percentile
Published
2022-07-06T13:11Z
EPSS history
Timeline
  • 06 JUL 13:11Z
    Priority - Priority User Enumeration
    cvelistv5