Description

Response discrepancy in the login and password reset forms in SilverStripe CMS before 3.5.5 and 3.6.x before 3.6.1 allows remote attackers to enumerate users via timing attacks.

Remediation

References

CVE-2017-12849

Related Vulnerabilities

MediaWiki Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2024-23174)

WordPress Plugin BuddyPress PHP Object Injection (2.0.2)

phpMyFAQ Improper Access Control Vulnerability (CVE-2023-1883)

WebLogic Improper Access Control Vulnerability (CVE-2016-5601)

WordPress Plugin WP Construction Mode Cross-Site Request Forgery (3.31)

Severity

Medium

Classification

CVE-2017-12849 CWE-200 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Tags

Missing Update Known Vulnerabilities