CVE-2023-40766
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk50th percentile - higher than 50% of all known CVEs
Summary
User enumeration is found in PHPJabbers Ticket Support Script v3.2. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.
Risk Assessment
The organization may be exposed to brute force attacks, potentially leading to unauthorized access to user accounts. This increases the risk of data breaches and security violations.
Recommendation
It is recommended to implement uniform messages during the password recovery process to minimize the risk of user enumeration. Additionally, consider implementing extra security measures, such as limiting the number of login attempts.
Other vulnerabilities in PHPJabbers Ticket Support Script v3.2
See all- CVE-2023-39776Critical
CVE-2023-39776 describes a vulnerability in PHPJabbers Ticket Support Script v3.2 that allows attackers to execute arbitrary code by uploading a crafted file.
- CVE-2023-40753Medium
There is a Cross Site Scripting (XSS) vulnerability in the message parameter of index.php in PHPJabbers Ticket Support Script v3.2.
Original NVD description (English source)
User enumeration is found in in PHPJabbers Ticket Support Script v3.2. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.