CVE-2022-39314
published 2022-10-24CVE-2022-39314: Kirby is a flat-file CMS. In versions prior to 3.5.8.2, 3.6.6.2, 3.7.5.1, and 3.8.1, Kirby is subject to user enumeration due to Improper Restriction of…
PriorityP416low3.7CVSS 3.1
AVNACHPRNUINSUCLINAN
EPSS
0.35%
26.8th percentile
Kirby is a flat-file CMS. In versions prior to 3.5.8.2, 3.6.6.2, 3.7.5.1, and 3.8.1, Kirby is subject to user enumeration due to Improper Restriction of Excessive Authentication Attempts. This vulnerability affects you only if you are using the `code` or `password-reset` auth method with the `auth.methods` option or if you have enabled the `debug` option in production. By using two or more IP addresses and multiple login attempts, valid user accounts will lock, but invalid accounts will not, leading to account enumeration. This issue has been patched in versions 3.5.8.2, 3.6.6.2, 3.7.5.1, and 3.8.1. If you cannot update immediately, you can work around the issue by setting the `auth.methods` option to `password`, which disables the code-based login and password reset forms.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| getkirby | cms | >= 3.5.0 < 3.5.8.2 | 3.5.8.2 |
| getkirby | cms | >= 3.6.0 < 3.6.6.2 | 3.6.6.2 |
| getkirby | cms | >= 3.7.0 < 3.7.5.1 | 3.7.5.1 |
| getkirby | cms | >= 3.8.0 < 3.8.1 | 3.8.1 |
| getkirby | kirby | < 3.5.8.2 | 3.5.8.2 |
| getkirby | kirby | — | — |
| getkirby | kirby | — | — |
| getkirby | kirby | — | — |
| getkirby | kirby | — | — |
| getkirby | kirby | — | — |
| getkirby | kirby | >= 3.6.0 < 3.6.6.2 | 3.6.6.2 |
| getkirby | kirby | >= 3.7.0 < 3.7.5.1 | 3.7.5.1 |
CVSS provenance
nvdv3.13.7LOWCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
nvdv3.04.8MEDIUMCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Kirby CMS vulnerable to user enumeration in the code-based login and password reset forms
osv·2022-10-18
CVE-2022-39314 [MEDIUM] Kirby CMS vulnerable to user enumeration in the code-based login and password reset forms
Kirby CMS vulnerable to user enumeration in the code-based login and password reset forms
### TL;DR
This vulnerability only affects you if you are using the `code` or `password-reset` auth method with the `auth.methods` option. It can only be successfully exploited under server configuration conditions outside of the attacker's control.
----
### Introduction
User enumeration is a type of vulnerability that allows attackers to confirm which users are registered in a Kirby installation. This information can be abused for social engineering attacks against users of the site or to find out the organizational structure of the company.
User enumeration attacks are performed by entering an existing and a non-existing user into the email address field of the login form. If the system returns
GHSA
Kirby CMS vulnerable to user enumeration in the code-based login and password reset forms
ghsa·2022-10-18
CVE-2022-39314 [MEDIUM] CWE-204 Kirby CMS vulnerable to user enumeration in the code-based login and password reset forms
Kirby CMS vulnerable to user enumeration in the code-based login and password reset forms
### TL;DR
This vulnerability only affects you if you are using the `code` or `password-reset` auth method with the `auth.methods` option. It can only be successfully exploited under server configuration conditions outside of the attacker's control.
----
### Introduction
User enumeration is a type of vulnerability that allows attackers to confirm which users are registered in a Kirby installation. This information can be abused for social engineering attacks against users of the site or to find out the organizational structure of the company.
User enumeration attacks are performed by entering an existing and a non-existing user into the email address field of the login form. If the system returns
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2022-10-24
Published