CVE-2024-2464

Description

This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.This issue affects CDeX application versions through 5.7.1.

Reserved 2024-03-14 | Published 2024-03-21 | Updated 2024-10-30 | Assigner CERT-PL

Problem types

CWE-203 Observable Discrepancy

Product status

Default status
unaffected

Any version
affected

Credits

Michał Walkowski, PhD finder

References

cert.pl/en/posts/2024/03/CVE-2024-2463/ third-party-advisory

cert.pl/posts/2024/03/CVE-2024-2463/ third-party-advisory

cdex.cloud/ product

cve.org (CVE-2024-2464)

nvd.nist.gov (CVE-2024-2464)

Download JSON