CVE-2023-40756
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk50th percentile - higher than 50% of all known CVEs
Summary
User enumeration is found in PHPJabbers Callback Widget v1.0 during the password recovery process. Differences in messages could allow an attacker to determine if a user is valid, enabling a brute force attack on valid users.
Risk Assessment
The organization may be exposed to brute force attacks, potentially leading to unauthorized access to user accounts. This increases the risk of data breaches and security violations.
Recommendation
It is recommended to implement uniform messages for all users during the password recovery process to minimize the risk of user enumeration.
Other vulnerabilities in PHPJabbers Callback Widget v1.0
See all- CVE-2023-40755Medium
There is a Cross Site Scripting (XSS) vulnerability in the 'theme' parameter of preview.php in PHPJabbers Callback Widget v1.0.
- CVE-2023-36315Medium
There is a Cross Site Scripting (XSS) vulnerability in the 'action' parameter of index.php in PHPJabbers Callback Widget v1.0.
- CVE-2023-36314Medium
There is a Cross Site Scripting (XSS) vulnerability in the value-text-o_sms_email_request_message parameters of index.php in PHPJabbers Callback Widget v1.0.
- CVE-2023-36312Medium
There is a Cross Site Scripting (XSS) vulnerability in the value-enum-o_bf_include_timezone parameter of index.php in PHPJabbers Callback Widget v1.0. An attacker can exploit this vulnerability to inject malicious scripts.
Original NVD description (English source)
User enumeration is found in PHPJabbers Callback Widget v1.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.