CVE-2024-47059 | THREATINT

We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Crisp.chat (Helpdesk and Chat)

Ok

Description

When logging in with the correct username and incorrect weak password, the user receives the notification, that their password is too weak. However when an incorrect username is provided alongside with a weak password, the application responds with ’Invalid credentials’ notification. This difference could be used to perform username enumeration.

Reserved 2024-09-17 | Published 2024-09-18 | Updated 2024-09-25 | Assigner Mautic

MEDIUM: 4.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Problem types

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

Product status

Default status

unaffected

>= 5.1.0 before < 5.1.1

affected

Timeline

2024-08-06:	Issue reported
2024-08-06:	Fix proposed
2023-09-17:	QA passed

Credits

Patryk Gruszka remediation reviewer

John Linhart remediation verifier

Tomasz Kowalczyk remediation developer

Rafał Kamiński finder

References

github.com/...mautic/security/advisories/GHSA-8vff-35qm-qjvv

cve.org (CVE-2024-47059)

nvd.nist.gov (CVE-2024-47059)

Download JSON

https://cve.threatint.com/CVE/CVE-2024-47059

Support options

Helpdesk Chat, Email, Knowledgebase
Telegram Chat

Subscribe to our newsletter to learn more about our work.