GitHub Advisoryadvisory · Packagist

GHSA-wmwf-49vv-p3mr Sulu Observable Response Discrepancy on Admin Login

MEDIUM Published 2023-08-03 Modified 2023-08-04 Official page ↗
Aliases
CVE-2023-39343
Ecosystem
Packagist
Packages
sulu/sulu
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-204
Reviewed
2023-08-03

Affected packages

• Packagist sulu/sulu: >= 2.5.0, < 2.5.10 → fixed in 2.5.10

Description

Impact It allows over the Admin Login form to detect which user (username, email) exists and which one do not exist. Impacted by this issue are Sulu installation >= 2.5.0 and getMessage();` instead the `$exception->getMessageKey();` References Currently no references.

Related

Alias · CVE (1)

  • CVE-2023-39343 Sulu is an open-source PHP content management system based on the Symfony framework. vulnerability

Weakness · CWE (1)

  • CWE-204 Observable Response Discrepancy weakness

References