Lucene search

MitreCVE-2023-36135

HistoryAug 04, 2023 - 12:15 a.m.

CVE-2023-36135

2023-08-0400:15:12

mitre

web.nvd.nist.gov

cve-2023-36135

user enumeration

phpjabbers

class scheduling system

password recovery

brute force attack

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.4

Confidence

High

EPSS

0.001

Percentile

50.8%

JSON

User enumeration is found in in PHPJabbers Class Scheduling System v1.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.

Affected configurations

Nvd

Node

phpjabbersclass_scheduling_systemMatch1.0

VendorProductVersionCPE
phpjabbersclass_scheduling_system1.0cpe:2.3:a:phpjabbers:class_scheduling_system:1.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
phpjabbers	class_scheduling_system	1.0	cpe:2.3:a:phpjabbers:class_scheduling_system:1.0:::::::*

References

medium.com/%40bcksec/multiple-vulnerabilities-in-php-jabbers-scripts-25af4afcadd4

www.phpjabbers.com/class-scheduling-system

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.4

Confidence

High

EPSS

0.001

Percentile

50.8%

JSON

Related for CVE-2023-36135