GitHub Advisoryadvisory · Packagist

GHSA-8889-9g3f-73rj Pimcore Discloses Usernames In Use

HIGH Published 2022-05-24 Modified 2023-09-26 Official page ↗
Aliases
CVE-2019-18986
Ecosystem
Packagist
Packages
pimcore/pimcore
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-307
Reviewed
2023-07-18

Affected packages

• Packagist pimcore/pimcore: < 6.2.2 → fixed in 6.2.2

Description

Pimcore before 6.2.2 allow attackers to brute-force (guess) valid usernames by using the 'forgot password' functionality as it returns distinct messages for invalid password and non-existing users.

Related

Alias · CVE (1)

  • CVE-2019-18986 Pimcore before 6.2.2 allow attackers to brute-force (guess) valid usernames by using the 'forgot password' functionality as it returns… vulnerability

Weakness · CWE (1)

  • CWE-307 Improper Restriction of Excessive Authentication Attempts weakness

References