VulnerabilityModified
CVE-2022-30332
This allows remote attackers to enumerate accounts via a series of requests.
MEDIUM 5.3EPSS 0.84%
Does this matter?
Lower severity and a low EPSS score (0.84%). Track it; it rarely justifies an emergency change on its own.
Description
In Talend Administration Center 7.3.1.20200219 before TAC-15950, the Forgot Password feature provides different error messages for invalid reset attempts depending on whether the email address is associated with any account. This allows remote attackers to enumerate accounts via a series of requests.
- CVSS 3.1
- 5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- EPSS
- 0.84% probability · 56th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-203
- Affected
- talend/administration center
- Source
- cve@mitre.org
References
- https://cds.thalesgroup.com/en/tcs-cert/CVE-2022-30332
- https://cwe.mitre.org/data/definitions/204.htmlTechnical Description
- https://excellium-services.com/cert-xlm-advisory/CVE-2022-30332Third Party Advisory
- https://help.talend.com/r/62tbPt7y~tPTxAB7y7KpeQ/H45WqEF32geNEZiGJnRwmwBroken Link, Release Notes, Vendor Advisory
- https://cwe.mitre.org/data/definitions/204.htmlTechnical Description
- https://excellium-services.com/cert-xlm-advisory/CVE-2022-30332Third Party Advisory
- https://help.talend.com/r/62tbPt7y~tPTxAB7y7KpeQ/H45WqEF32geNEZiGJnRwmwBroken Link, Release Notes, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.