CVE-2022-40084 OpenCRX vulnerable to password enumeration via error messages in password reset
An attacker can enumerate valid usernames, emails, or IDs by analyzing error message differences during password reset requests in OpenCRX.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-40084?
CVE-2022-40084 is a medium-severity vulnerability in n/a, published on 20 Oct 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
OpenCRX before v5.2.2 was discovered to be vulnerable to password enumeration due to the difference in error messages received during a password reset which could enable an attacker to determine if a username, email or ID is valid.
Weakness: CWE-203
Which versions are affected by CVE-2022-40084?
2 open source packages ship an affected version, including org.opencrx:opencrx-client. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.opencrx:opencrx-client Maven | All versions | 5.2.2 |
org.opencrx:opencrx-client Maven | All versions | 5.2.2 |
Products include Opencrx Opencrx.
How do I fix CVE-2022-40084?
Upgrade org.opencrx:opencrx-client to 5.2.2 or later.
Is CVE-2022-40084 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-40084 exists.
Other vulnerabilities in n/a
Sources
Also known as GHSA-j5v3-363p-g843.