CVE-2021-44848

In Cibele Thinfinity VirtualUI before 3.0, /changePassword returns different responses for invalid authentication requests depending on whether the username exists.

Score

CVSS 3.1 5.3 Medium

Status

Modified - cve@mitre.org

Published

2021-12-13

Last modified

2024-08-04

Weaknesses

CWE-203

Affected products

• Thinfinity Virtualui (Cybelesoft)

References

• http://packetstormsecurity.com/files/165327/Cibele-Thinfinity-VirtualUI-2.5.41.0-User-Enumeration.html
• https://github.com/cybelesoft/virtualui/issues/1