Skip to main content

Observable Discrepancy

CVE-2023-38871

Medium
5.3/10

Summary

The gugoan/economizzer has a user enumeration vulnerability in the "login" and "forgot password" functionalities. The app reacts differently when a user or email address is valid, and when it's not. This may allow an attacker to determine whether a user or email address is valid, or brute force valid "usernames" and "email" addresses.

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • NONE
  • NONE
  • LOW
  • NONE

CWE-203 - Observable Discrepancy

The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.

References

Advisory Timeline

  • Published