Description
EspoCRM 5.6.4 is vulnerable to user password hash enumeration. A malicious authenticated attacker can brute-force a user password hash by 1 symbol at a time using specially crafted api/v1/User?filterList filters.
Remediation
References
Related Vulnerabilities
WordPress 5.5.x Multiple Vulnerabilities (5.5 - 5.5.7)
Opencart Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2010-1610)
Joomla Improper Access Control Vulnerability (CVE-2016-9836)
WordPress Plugin Catch Themes Demo Import Arbitrary File Upload (1.7)
Lighttpd Resource Management Errors Vulnerability (CVE-2012-5533)