CVE-2022-23172
MEDIUMPriority < 22.0 - User Enumeration via Forgot Password Feature
Title source: llmDescription
An attacker can access to "Forgot my password" button, as soon as he puts users is valid in the system, the system would issue a message that a password reset email had been sent to user. This way you can verify which users are in the system and which are not.
References (1)
Core 1
Core References
Third Party Advisory x_refsource_misc
https://www.gov.il/en/departments/faq/cve_advisories
Scores
CVSS v3
5.5
EPSS
0.0037
EPSS Percentile
28.4%
Attack Vector
ADJACENT_NETWORK
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Details
CWE
CWE-640
Status
published
Products (1)
priority-software/priority
< 22.0
Published
Jul 06, 2022
Tracked Since
Feb 18, 2026