VulnerabilityModified
CVE-2022-32741
Attacker is able to determine if the provided username exists (and it's valid) using Request New Password feature, based on the response time.
MEDIUM 5.3EPSS 0.84%
Does this matter?
Lower severity and a low EPSS score (0.84%). Track it; it rarely justifies an emergency change on its own.
Description
Attacker is able to determine if the provided username exists (and it's valid) using Request New Password feature, based on the response time.
- CVSS 3.1
- 5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- EPSS
- 0.84% probability · 56th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-200
- Affected
- otrs/otrs
- Source
- security@otrs.com
References
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.