CVE-2022-40084

MEDIUM

opencrx < 5.2.2 - User Enumeration via Password Reset Error Message Discrepancy

Title source: llm

Description

OpenCRX before v5.2.2 was discovered to be vulnerable to password enumeration due to the difference in error messages received during a password reset which could enable an attacker to determine if a username, email or ID is valid.

References (2)

Core 2

Core References

Various Sources

https://cwe.mitre.org/data/definitions/204.html#:~:text=User%20enumeration%20via%20discrepancies%20in%20error%20messages.%2C-CVE-2004-0294&text=Bulletin%20Board%20displays%20different%20error%2Cbrute%20force%20password%20guessing%20attack.

Exploit, Third Party Advisory

https://github.com/ciph0x01/OpenCRX-CVE/blob/main/CVE-2022-40084.md

View Exploit ZIP pw:eip

Scores

CVSS v3 5.3

EPSS 0.0063

EPSS Percentile 45.5%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation poc

Automatable yes

Technical Impact partial

Details

CWE

CWE-203

Status published

Products (2)

opencrx/opencrx < 5.2.2

org.opencrx/opencrx-client 0 - 5.2.2Maven

Published Oct 20, 2022

Tracked Since Feb 18, 2026