Brute Force Vulnerability in HumHub Social Network Kit by HumHub
CVE-2019-12743

5.3MEDIUM

Key Information:

Vendor

Humhub

Status
Social Network Kit
Vendor
CVE Published:
29 July 2019

What is CVE-2019-12743?

The HumHub Social Network Kit Enterprise v1.3.13 is susceptible to a vulnerability that enables remote attackers to enumerate user accounts by systematically guessing usernames. This occurs through a flaw in the handling of specific URI patterns, which inadvertently reveals the existence of accounts based on the responses received during brute-force attempts. By exploiting this weakness, an attacker can determine valid usernames on the platform, posing significant privacy and security risks to users.

References

https://humhub.org/en/news
x_refsource_MISC
https://github.com/chanpu9/CVE/blob/master/2019-12743
x_refsource_MISC

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.