ibexa/user · Security
ibexa/user login enumerates user accounts
- GHSA ID
- GHSA-q3x8-6898-23g3
- Severity
- medium
- Published
- Updated
- CVSS v4
- 6.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Description
Impact
In v5, error messages could provide enough information to tell whether a user exists or not. This is resolved by ensuring the error messages are sufficiently ambigious.
Patches
See "Patched versions".
Workarounds
None.
Resources
CWEs
- CWE-209 · Generation of Error Message Containing Sensitive Information