User account enumeration in Serenity

2023-04-2703:30:23

CWE-209

GitHub Advisory Database

github.com

user account enumeration

serenity

startsharp

password reset

server response

user existence

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS

0.001

Percentile

37.4%

JSON

An issue was discovered in Serenity Serene (and StartSharp) before 6.7.0. When a password reset request occurs, the server response leaks the existence of users. If one tries to reset a password of a non-existent user, an error message indicates that this user does not exist.

Affected configurations

Vulners

Node

serenity.net.webRange<6.7.0

serenity.net.coreRange<6.7.0

VendorProductVersionCPE
*serenity.net.web*cpe:2.3:a:*:serenity.net.web:*:*:*:*:*:*:*:*
*serenity.net.core*cpe:2.3:a:*:serenity.net.core:*:*:*:*:*:*:*:*