CVE-2023-36141
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
User enumeration is found in PHPJabbers Cleaning Business Software version 1.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.
Risk Assessment
The organization may be exposed to brute force attacks, potentially leading to unauthorized access to user accounts. This increases the risk of data leaks and security breaches.
Recommendation
It is recommended to implement uniform messages during the password recovery process to minimize the risk of revealing information about valid users. Additionally, consider implementing mechanisms to limit the number of login attempts.
Other vulnerabilities in PHPJabbers Cleaning Business Software 1.0
See all- CVE-2023-36139Critical
In PHPJabbers Cleaning Business Software version 1.0, lack of verification when changing an email address and/or password on the Profile Page allows remote attackers to take over accounts.
- CVE-2023-36138Medium
PHPJabbers Cleaning Business Software version 1.0 is vulnerable to Cross Site Scripting (XSS) via the theme parameter of preview.php.
Original NVD description (English source)
User enumeration is found in in PHPJabbers Cleaning Business Software 1.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.