Username enumeration using the forget password endpoint

Advisory ID: LVD-2024-0002

CVSSv 3.1 Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CVSSv 3.1 Base Score: 5.3

Severity: Medium

CVE: CVE-2024-33856

CWE: CWE-204

Date Published: 2024-04-30

Description:

An attacker can enumerate a valid list of usernames by observing the response time at the Forgot Password endpoint.

Affected Product:

Logpoint versions before 7.4.0 

Solution:

Upgrade to Logpoint v7.4.0

Acknowledgments: -