CVE-2020-24008

MEDIUM

Umanni RH 1.0 - User Enumeration via Password Recovery Message Discrepancy

Title source: llm

Description

Umanni RH 1.0 has a user enumeration vulnerability. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.

References (2)

Core 2

Core References

Vendor Advisory x_refsource_misc

https://www.umanni.com.br/

Exploit, Issue Tracking, Third Party Advisory x_refsource_misc

https://github.com/inflixim4be/User-Enumeration-on-Umanni-RH

View Exploit ZIP pw:eip

Scores

CVSS v3 5.3

EPSS 0.0091

EPSS Percentile 55.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Details

CWE

CWE-203

Status published

Products (1)

umanni/human_resources 1.0

Published Aug 26, 2020

Tracked Since Feb 18, 2026