CVE-2023-40764
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk50th percentile - higher than 50% of all known CVEs
Summary
User enumeration is found in PHP Jabbers Car Rental Script v3.0 during the password recovery process. Differences in messages could allow an attacker to determine if a user is valid, facilitating a brute force attack on user accounts.
Risk Assessment
The organization may be exposed to brute force attacks, potentially leading to account takeovers. This could result in data loss and breaches of user privacy.
Recommendation
It is recommended to implement uniform messages for all users during the password recovery process to minimize the risk of user enumeration. Additionally, consider implementing extra security measures such as limiting the number of login attempts.
Original NVD description (English source)
User enumeration is found in PHP Jabbers Car Rental Script v3.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.