Username Enumeration Vulnerability in Backdrop CMS by Backdrop
CVE-2022-34530

5.3MEDIUM

Key Information:

Vendor

Backdropcms

Status
Backdrop Cms
Vendor
CVE Published:
1 August 2022

What is CVE-2022-34530?

A security flaw in Backdrop CMS v1.22.0 allows attackers to exploit the password reset feature. By sending password reset requests, they can infer valid usernames through the distinct responses generated based on the username input. This vulnerability can lead to unauthorized access attempts and should be addressed promptly to secure user accounts.

References

https://github.com/Accenture/AARO-Bugs/blob/master/AARO-C...
x_refsource_MISC
http://backdrop.com
x_refsource_MISC

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.