Lucene search

GoogleOSV:CVE-2024-22647

HistoryJan 30, 2024 - 7:15 a.m.

CVE-2024-22647

2024-01-3007:15:08

Google

osv.dev

seo panel

user enumeration

brute-force

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

6.7 Medium

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

17.1%

JSON

An user enumeration vulnerability was found in SEO Panel 4.10.0. This issue occurs during user authentication, where a difference in error messages could allow an attacker to determine if a username is valid or not, enabling a brute-force attack with valid usernames.

CPENameOperatorVersion
seo-paneleq4.10.0
seo-paneleq4.2.0
seo-paneleq4.4.0
seo-paneleq4.8.0
seo-paneleq4.9.0
seo-paneleq4.3.0
seo-paneleq4.5.0
seo-paneleq4.7.0
seo-paneleq4.6.0

Name	Operator	Version
seo-panel	eq	4.10.0
seo-panel	eq	4.2.0
seo-panel	eq	4.4.0
seo-panel	eq	4.8.0
seo-panel	eq	4.9.0
seo-panel	eq	4.3.0
seo-panel	eq	4.5.0
seo-panel	eq	4.7.0
seo-panel	eq	4.6.0

References

github.com/cassis-sec/CVE/tree/main/2024/CVE-2024-22647

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

6.7 Medium

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

17.1%

JSON

Related for OSV:CVE-2024-22647