CVE-2022-34530

41th percentile - higher than 41% of all known CVEs

An issue in the login and reset password functionality of Backdrop CMS v1.22.0 allows attackers to enumerate usernames via password reset requests and distinct responses returned based on usernames.

The risk is that an attacker can compile a list of valid usernames, which can be used as a stepping stone for brute-force or social engineering attacks against administrator and user accounts.

It is recommended to immediately update Backdrop CMS to the latest stable version that fixes this vulnerability. If an update is not possible, consider implementing temporary mitigations such as restricting access to the login page or deploying response-delaying mechanisms.