PT-2019-12913 · Humhub · Humhub Social Network Kit

Chanpu9 · Published 2019-07-29 · Updated 2021-07-21 · CVE-2019-12743

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions HumHub Social Network Kit Enterprise version 1.3.13

Description The issue allows remote attackers to find existing user accounts on Social Network Kits, including self-hosted ones, by brute-forcing the username after the "/u/" initial URI substring. This is due to a response discrepancy information exposure.

Recommendations For HumHub Social Network Kit Enterprise version 1.3.13, consider restricting access to the "/u/" API endpoint to minimize the risk of exploitation until a patch is available. As a temporary workaround, implement rate limiting or IP blocking to prevent brute-force attacks on user accounts.

Exploit

Fix

Side Channel Attack

Weakness Enumeration

CWE-203

Related Identifiers

CVE-2019-12743

Affected Products

Humhub Social Network Kit

References · 4

• 🔥 https://github.com/chanpu9/CVE/blob/master/2019-12743 · Exploit
• https://osv.dev/vulnerability/CVE-2019-12743 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-12743 · Security Note
• https://humhub.org/en/news · Note