Vulnerability Details : CVE-2019-12743
HumHub Social Network Kit Enterprise v1.3.13 allows remote attackers to find the user accounts existing on any Social Network Kits (including self-hosted ones) by brute-forcing the username after the /u/ initial URI substring, aka Response Discrepancy Information Exposure.
Products affected by CVE-2019-12743
- cpe:2.3:a:humhub:social_network_kit:1.3.13:*:*:*:enterprise:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2019-12743
0.24%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 45 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2019-12743
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
5.0
|
MEDIUM | AV:N/AC:L/Au:N/C:P/I:N/A:N |
10.0
|
2.9
|
NIST | |
|
5.3
|
MEDIUM | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
3.9
|
1.4
|
NIST |
CWE ids for CVE-2019-12743
-
The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.Assigned by: nvd@nist.gov (Primary)
References for CVE-2019-12743
-
https://github.com/chanpu9/CVE/blob/master/2019-12743
CVE/2019-12743 at master · chanpu9/CVE · GitHubThird Party Advisory
-
https://humhub.org/en/news
HumHub - The flexible Open Source Social Network Kit for CollaborationProduct;Release Notes
Jump to