CVE-2022-32741CWE-200

Information disclosure in Request New Password feature

Medium · published June 13, 2022

CVSS v3.1
5.3
EPSS
1%
Percentile
58.1
In the wild
Unconfirmed
What it is

Attacker is able to determine if the provided username exists (and it's valid) using Request New Password feature, based on the response time.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00861 · 58.1th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2022-06-13T08:01Z
EPSS history
Timeline
  • 13 JUN 08:01Z
    Information disclosure in Request New Password feature
    cvelistv5