medium5.3Public exploit code
CVE-2021-44848
In Cibele Thinfinity VirtualUI before 3.0, /changePassword returns different responses for invalid authentication requests depending on whether the username ex…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Cibele Thinfinity VirtualUI 2.5.41.0 - User Enumeration2021-12-16 · webapps · multiple
Impact
In Cibele Thinfinity VirtualUI before 3.0, /changePassword returns different responses for invalid authentication requests depending on whether the username exists.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Cybelesoft | Thinfinity Virtualui | before 3.0 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/165327/Cibele-Thinfinity-VirtualUI-2.5.41.0-User-Enumeration.html
- https://github.com/cybelesoft/virtualui/issues/1
- http://packetstormsecurity.com/files/165327/Cibele-Thinfinity-VirtualUI-2.5.41.0-User-Enumeration.html
- https://github.com/cybelesoft/virtualui/issues/1