Design/Logic Flaw

2019-07-2916:15:00

PRIOn knowledge base

www.prio-n.com

5.4 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

54.7%

JSON

HumHub Social Network Kit Enterprise v1.3.13 allows remote attackers to find the user accounts existing on any Social Network Kits (including self-hosted ones) by brute-forcing the username after the /u/ initial URI substring, aka Response Discrepancy Information Exposure.

CPENameOperatorVersion
social_network_kiteq1.3.13

CPE	Name	Operator	Version
	social_network_kit	eq	1.3.13

References

github.com/chanpu9/CVE/blob/master/2019-12743

humhub.org/en/news