Observable Response Discrepancy in Lost Password Service
### Impact It is possible to enumerate usernames via the forgot password functionality ### Patches Update to version `10.1.3` or apply this patch manually: https://github.com/pimcore/pimcore/pull/10223.patch ### Workarounds Apply https://github.com/pimcore/pimcore/pull/10223.patch manually.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2021-39189US | medium5.0 | — | ||
Pimcore is an open source data & experience management platform. In versions prior to 10.1.3, it is possible to enumerate usernames via the forgot password functionality. This issu… | ||||
02
references
External citations — patches, advisories, analysis.
- https://github.com/pimcore/pimcorePACKAGE
- https://github.com/pimcore/pimcore/pull/10223.patchWEB
- https://github.com/pimcore/pimcore/pull/10223/commits/d0a4de39cf05dce6af71f8ca039132bdfcbb0dceWEB
- https://github.com/pimcore/pimcore/security/advisories/GHSA-579x-cjvr-cqj9WEB
- https://huntr.dev/bounties/12462a99-ebf8-4e39-80b3-54a16caa3f4cWEB
- https://nvd.nist.gov/vuln/detail/CVE-2021-39189ADVISORY
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan