Account Enumeration Vulnerability in eZ Publish by Ibexa
CVE-2021-46876

5.3MEDIUM

Key Information:

Vendor

Ibexa

Status
Ez Platform Kernel
Vendor
CVE Published:
12 March 2023

What is CVE-2021-46876?

An issue in eZ Publish Ibexa Kernel allows attackers to exploit the /user/sessions endpoint, enabling them to ascertain the existence of user accounts. This vulnerability could lead to further attacks, making it essential for users of affected versions to apply necessary security updates.

References

https://github.com/ezsystems/ezpublish-kernel/commit/b496...
https://github.com/ezsystems/ezpublish-kernel/security/ad...

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.