Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1qNXYzLTM2M3AtZzg0M84AAve_

OpenCRX vulnerable to password enumeration via error messages in password reset

OpenCRX before v5.2.2 was discovered to be vulnerable to password enumeration due to the difference in error messages received during a password reset which could enable an attacker to determine if a username, email or ID is valid.

Permalink: https://github.com/advisories/GHSA-j5v3-363p-g843
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1qNXYzLTM2M3AtZzg0M84AAve_
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: over 1 year ago
Updated: over 1 year ago

CVSS Score: 5.3
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Identifiers: GHSA-j5v3-363p-g843, CVE-2022-40084
References:

• https://nvd.nist.gov/vuln/detail/CVE-2022-40084
• https://github.com/ciph0x01/OpenCRX-CVE/blob/main/CVE-2022-40084.md
• https://cwe.mitre.org/data/definitions/204.html
• https://github.com/advisories/GHSA-j5v3-363p-g843

Repository: https://github.com/ciph0x01/OpenCRX-CVE
Blast Radius: 1.0

Affected Packages