PT-2022-12203 · Unknown · Buddyboss Platform

Published 2022-01-26 · Updated 2022-02-02 · CVE-2021-44692

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions BuddyBoss Platform versions 1.8.0 and earlier

Description The issue allows remote attackers to obtain the email address of each user. When creating a new user, a Unique ID is generated for their profile, which is their private email address with symbols removed and periods replaced with hyphens. For example, [e-mail] would become /members/johndoeexample-com and [e-mail] would become /members/jo-testexample-com. The members list is available to everyone and, in a default configuration, often without authentication, making it trivial to collect a list of email addresses.

Recommendations For BuddyBoss Platform versions 1.8.0 and earlier, consider restricting access to the members list to minimize the risk of exploitation, as it is available to everyone and often without authentication in the default configuration. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2021-44692

Affected Products

Buddyboss Platform

References · 6

• https://buddyboss.com/resources/buddyboss-platform-releases · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-44692 · Security Note
• https://osv.dev/vulnerability/CVE-2021-44692 · Vendor Advisory
• https://t.me/cvenotify/25866 · Telegram Post
• https://t.me/cibsecurity/36313 · Telegram Post
• https://cygenta.co.uk/post/buddyboss · Note