VulnerabilityDeferred

CVE-2024-54454

An Observable Response Discrepancy vulnerability in the sendPasswordReinitLink action of the unlogged.do page allows remote attackers to test whether a username is valid or not.

MEDIUM 5.3EPSS 0.37%

Does this matter?

Lower severity and a low EPSS score (0.37%). Track it; it rarely justifies an emergency change on its own.

Description

An issue was discovered in Kurmi Provisioning Suite before 7.9.0.35, 7.10.x through 7.10.0.18, and 7.11.x through 7.11.0.15. An Observable Response Discrepancy vulnerability in the sendPasswordReinitLink action of the unlogged.do page allows remote attackers to test whether a username is valid or not. This allows confirmation of valid usernames.

CVSS 3.1: 5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS: 0.37% probability · 30th percentile
CISA KEV: Not listed
Weakness: CWE-203
Source: cve@mitre.org

References

https://kurmi-software.com
https://kurmi-software.com/cve-2024-54454/

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.