CVE-2022-40895 Information disclosure in n/a
An unauthenticated attacker can enumerate valid users via the forgot password utility, facilitating brute force attacks against the NeDi web interface.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-40895?
CVE-2022-40895 is a critical vulnerability in n/a, published on 6 Oct 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In certain Nedi products, a vulnerability in the web UI of NeDi login & Community login could allow an unauthenticated, remote attacker to affect the integrity of a device via a User Enumeration vulnerability. The vulnerability is due to insecure design, where a difference in forgot password utility could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users. This affects NeDi 1.0.7 for OS X 1.0.7 <= and NeDi for Suse 1.0.7 <= and NeDi for FreeBSD 1.0.7 <=.
Weakness: CWE-203
Which versions are affected by CVE-2022-40895?
It affects 1 product.
Products include Nedi Nedi.
How do I fix CVE-2022-40895?
No fix has been published for CVE-2022-40895 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-40895 being exploited?
There is no known exploitation of CVE-2022-40895 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-8c7m-p9hj-2j62.