Cibele Thinfinity VirtualUI 2.5.41.0 - User Enumeration Vulnerability

Exploit Title: Cibele Thinfinity VirtualUI 2.5.41.0 - User Enumeration Exploit Author: Daniel Morales, IT Security Team - ARHS Spikeseed Vendor Homepage: https://www.cybelesoft.com Software Link: https://www.cybelesoft.com/thinfinity/virtualui/ Version: vulnerable v3.0 Tested on: Microsoft Window...

CVE-2021-44848

In Cibele Thinfinity VirtualUI before 3.0, /changePassword returns different responses for invalid authentication requests depending on whether the username exists...

PT-2021-24160

Name of the Vulnerable Software and Affected Versions: Cibele Thinfinity VirtualUI versions prior to 3.0 Description: The issue concerns the /changePassword endpoint, which returns different responses for invalid authentication requests depending on whether the username exists. This discrepancy c...