Information Disclosure Vulnerability in SPIP by SPIP Team
CVE-2019-16394
5.3MEDIUM
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC🟣 EPSS 39%
Summary
SPIP versions prior to 3.1.11 and 3.2 prior to 3.2.5 exhibit a vulnerability that allows attackers to differentiate between existing and non-existing email addresses via varying error messages on the password reminder page. This discrepancy could be exploited for subscriber enumeration, which poses a significant risk to user privacy and security.
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
References
EPSS Score
39% chance of being exploited in the next 30 days.
CVSS V3.1
Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged
Timeline
- 🟡
Public PoC available
- 👾
Exploit known to exist
Vulnerability published
Vulnerability Reserved