CVE-2023-31286 User account enumeration in Serenity
Attackers can enumerate valid users via password reset error messages, exposing user existence information.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-31286?
CVE-2023-31286 is a medium-severity vulnerability in n/a, published on 27 Apr 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in Serenity Serene (and StartSharp) before 6.7.0. When a password reset request occurs, the server response leaks the existence of users. If one tries to reset a password of a non-existent user, an error message indicates that this user does not exist.
Weakness: CWE-209
Which versions are affected by CVE-2023-31286?
4 open source packages ship an affected version, including Serenity.Net.Core and Serenity.Net.Web. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
Serenity.Net.Core NuGet | All versions | 6.7.0 |
Serenity.Net.Core NuGet | All versions | 6.7.0 |
Serenity.Net.Web NuGet | All versions | 6.7.0 |
Serenity.Net.Web NuGet | All versions | 6.7.0 |
Products include Serenity Serene, Serenity Startsharp.
How do I fix CVE-2023-31286?
Upgrade Serenity.Net.Core to 6.7.0 or later.
Is CVE-2023-31286 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-31286 exists.
Other vulnerabilities in n/a
Sources
Also known as GHSA-w7jm-9x4m-8qc3.