PT-2019-12913 · Humhub · Humhub Social Network Kit

Chanpu9 · Publicado 2019-07-29 · Atualizado 2021-07-21 · CVE-2019-12743

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions HumHub Social Network Kit Enterprise version 1.3.13

Description The issue allows remote attackers to find existing user accounts on Social Network Kits, including self-hosted ones, by brute-forcing the username after the "/u/" initial URI substring. This is due to a response discrepancy information exposure.

Recommendations For HumHub Social Network Kit Enterprise version 1.3.13, consider restricting access to the "/u/" API endpoint to minimize the risk of exploitation until a patch is available. As a temporary workaround, implement rate limiting or IP blocking to prevent brute-force attacks on user accounts.

Exploit

Correção

Side Channel Attack

Enumeração de Fraquezas

CWE-203

Identificadores relacionados

CVE-2019-12743

Produtos afetados

Humhub Social Network Kit

Referências · 4

• 🔥 https://github.com/chanpu9/CVE/blob/master/2019-12743 · Exploit
• https://osv.dev/vulnerability/CVE-2019-12743 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-12743 · Nota de Segurança
• https://humhub.org/en/news · Nota