CVE-2023-40760
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk50th percentile - higher than 50% of all known CVEs
Summary
User enumeration is found in PHP Jabbers Hotel Booking System v4.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.
Risk Assessment
The organization may be exposed to brute force attacks, which could lead to unauthorized access to user accounts. This could result in data loss or breaches of user privacy.
Recommendation
It is recommended to implement uniform messages during the password recovery process to minimize the risk of revealing information about valid users. Additionally, consider implementing mechanisms to protect against brute force attacks.
Original NVD description (English source)
User enumeration is found in PHP Jabbers Hotel Booking System v4.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.