GitHub Advisoryadvisory · Maven

GHSA-j5v3-363p-g843 OpenCRX vulnerable to password enumeration via error messages in password reset

MEDIUM Published 2022-10-20 Modified 2022-10-24 Official page ↗
Aliases
CVE-2022-40084
Ecosystem
Maven
Packages
org.opencrx:opencrx-client
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-203
Reviewed
2022-10-24

Affected packages

• Maven org.opencrx:opencrx-client: < 5.2.2 → fixed in 5.2.2

Description

OpenCRX before v5.2.2 was discovered to be vulnerable to password enumeration due to the difference in error messages received during a password reset which could enable an attacker to determine if a username, email or ID is valid.

Related

Alias · CVE (1)

  • CVE-2022-40084 OpenCRX before v5.2.2 was discovered to be vulnerable to password enumeration due to the difference in error messages received during a… vulnerability

Weakness · CWE (1)

  • CWE-203 Observable Discrepancy weakness

References