PT-2023-13003 · Talend · Talend Administration Center

Alexis Pain · Publicado 2023-01-10 · Atualizado 2024-07-03 · CVE-2022-30332

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Talend Administration Center version 7.3.1.20200219

Description The Forgot Password feature in the affected software provides different error messages for invalid reset attempts depending on whether the email address is associated with any account. This allows remote attackers to enumerate accounts via a series of requests to the Forgot Password feature.

Recommendations For Talend Administration Center version 7.3.1.20200219, update to a version that includes the fix for the issue, specifically after TAC-15950, to resolve the account enumeration vulnerability. As a temporary workaround, consider restricting access to the Forgot Password feature to minimize the risk of exploitation.

Correção

Side Channel Attack

Enumeração de Fraquezas

CWE-203

Identificadores relacionados

CVE-2022-30332

Produtos afetados

Talend Administration Center

Referências · 9

• https://cwe.mitre.org/data/definitions/204.html · Nota
• https://excellium-services.com/cert-xlm-advisory/CVE-2022-30332 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2022-30332 · Nota de Segurança
• https://help.talend.com/r/62tbPt7y~tPTxAB7y7KpeQ/H45WqEF32geNEZiGJnRwmw · Aviso do Fabricante
• https://t.me/cvenotify/42279 · Publicação no Telegram
• https://cds.thalesgroup.com/en/tcs-cert/CVE-2022-30332 · Nota
• https://t.me/cvenotify/82026 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2022-30332 · Aviso do Fabricante
• https://t.me/cvenotify/83630 · Publicação no Telegram