User Enumeration Vulnerability in Snipe-IT by Snipe-IT
CVE-2022-44381

5.3MEDIUM

Key Information:

Vendor

Snipeitapp

Status
Snipe-it
Vendor
CVE Published:
25 December 2022

What is CVE-2022-44381?

The vulnerability in Snipe-IT allows attackers to determine if a user account exists through inconsistent responses in the password reset functionality. Specifically, variations in server responses when verifying user accounts can enable adversaries to conduct targeted attacks, leading to potential data exposure and security breaches. This issue affects all versions up to 6.0.14, highlighting the importance of implementing robust security measures to prevent user enumeration.

References

https://census-labs.com/news/2022/12/23/multiple-vulnerab...

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.