CVE-2024-34336
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
User enumeration vulnerability in ORDAT FOSS-Online before v2.24.01 allows attackers to determine if an account exists by comparing server responses from the forgot password functionality.
Risk Assessment
The risk is that an attacker can compile a list of valid user accounts, which can be used for further attacks such as phishing or brute-force password attempts.
Recommendation
Immediately update ORDAT FOSS-Online to version 2.24.01 or later, which fixes this vulnerability.
Other vulnerabilities in ORDAT FOSS-Online
See all- CVE-2024-34335Medium
ORDAT FOSS-Online before version 2.24.01 was discovered to contain a reflected XSS vulnerability on the login page. An attacker can inject malicious script via a crafted request.
- CVE-2024-34334High
A SQL injection vulnerability was discovered in the forgot password function of ORDAT FOSS-Online before version 2.24.01. Attackers can exploit this flaw to manipulate database queries.
Original NVD description (English source)
User enumeration vulnerability in ORDAT FOSS-Online before v2.24.01 allows attackers to determine if an account exists in the application by comparing the server responses of the forgot password functionality.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS