CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS
Percentile
31.3%
Kirby is a flat-file CMS. In versions prior to 3.5.8.2, 3.6.6.2, 3.7.5.1, and 3.8.1, Kirby is subject to user enumeration due to Improper Restriction of Excessive Authentication Attempts. This vulnerability affects you only if you are using the code
or password-reset
auth method with the auth.methods
option or if you have enabled the debug
option in production. By using two or more IP addresses and multiple login attempts, valid user accounts will lock, but invalid accounts will not, leading to account enumeration. This issue has been patched in versions 3.5.8.2, 3.6.6.2, 3.7.5.1, and 3.8.1. If you cannot update immediately, you can work around the issue by setting the auth.methods
option to password
, which disables the code-based login and password reset forms.
Vendor | Product | Version | CPE |
---|---|---|---|
getkirby | kirby | * | cpe:2.3:a:getkirby:kirby:*:*:*:*:*:*:*:* |
getkirby | kirby | 3.8.0 | cpe:2.3:a:getkirby:kirby:3.8.0:-:*:*:*:*:*:* |
getkirby | kirby | 3.8.0 | cpe:2.3:a:getkirby:kirby:3.8.0:rc1:*:*:*:*:*:* |
getkirby | kirby | 3.8.0 | cpe:2.3:a:getkirby:kirby:3.8.0:rc2:*:*:*:*:*:* |
getkirby | kirby | 3.8.0 | cpe:2.3:a:getkirby:kirby:3.8.0:rc3:*:*:*:*:*:* |