Vulners
Lucene search
Cibele Thinfinity VirtualUI 2.5.41.0 User Enumeration
🗓️ 16 Dec 2021 00:00:00Reported by Daniel MoralesType 
packetstorm🔗 packetstormsecurity.com👁 365 Views
| Reporter | Title | Published | Views | Family All 10 |
|---|---|---|---|---|
 | Cibele Thinfinity VirtualUI 2.5.41.0 - User Enumeration Vulnerability | 16 Dec 202100:00 | – | zdt |
 | CVE-2021-44848 | 28 Jun 202218:24 | – | circl |
 | Cybele Software Thinfinity VirtualUI授权问题漏洞 | 13 Dec 202100:00 | – | cnnvd |
 | CVE-2021-44848 | 13 Dec 202101:08 | – | cve |
 | CVE-2021-44848 | 13 Dec 202101:08 | – | cvelist |
 | Cibele Thinfinity VirtualUI 2.5.41.0 - User Enumeration | 16 Dec 202100:00 | – | exploitdb |
 | Thinfinity VirtualUI User Enumeration | 7 Jun 202603:02 | – | nuclei |
| Thinfinity Iframe Injection | 7 Jun 202603:02 | – | nuclei |
 | CVE-2021-44848 | 13 Dec 202102:15 | – | nvd |
 | Authentication flaw | 13 Dec 202102:15 | – | prion |
10
`# Exploit Title: Cibele Thinfinity VirtualUI 2.5.41.0 - User Enumeration
# Date: 13/12/2021
# Exploit Author: Daniel Morales, IT Security Team - ARHS Spikeseed
# Vendor Homepage: https://www.cybelesoft.com
# Software Link: https://www.cybelesoft.com/thinfinity/virtualui/
# Version: vulnerable < v3.0
# Tested on: Microsoft Windows
# CVE: CVE-2021-44848
How it works: By accessing the vector, an attacker can determine if a username exists thanks to the message returned; it can be presented in different languages according to the configuration of VirtualUI. Common users are administrator, admin, guest...
Payload: The vulnerable vector is "https://example.com/changePassword?username=USERNAME" where "USERNAME" need to be brute-forced.
Reference: https://github.com/cybelesoft/virtualui/issues/1
`
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
16 Dec 2021 00:00Current
5.8Medium risk
Vulners AI Score5.8
CVSS 25
CVSS 3.15.3
EPSS0.61005