PT-2023-23273 · Unknown · Serenity Serene+1

Fabian Densborn · Published 2023-04-27 · Updated 2025-01-31 · CVE-2023-31286

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Serenity Serene versions prior to 6.7.0 StartSharp versions prior to 6.7.0

Description An issue was discovered where the server response to a password reset request leaks the existence of users. If a password reset is attempted for a non-existent user, the error message indicates that the user does not exist.

Recommendations For Serenity Serene versions prior to 6.7.0, update to version 6.7.0 or later to resolve the issue. For StartSharp versions prior to 6.7.0, update to version 6.7.0 or later to resolve the issue.

Exploit

Fix

Generation of Error Message Containing Sensitive Information

Weakness Enumeration

CWE-209

Related Identifiers

CVE-2023-31286

GHSA-W7JM-9X4M-8QC3

Affected Products

Serenity Serene

Startsharp

References · 9

• 🔥 https://seclists.org/fulldisclosure/2023/May/14 · Exploit
• https://github.com/serenity-is/Serenity/commit/11b9d267f840513d04b4f4d4876de7823a6e48d2 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-w7jm-9x4m-8qc3 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-31286 · Security Note
• https://osv.dev/vulnerability/CVE-2023-31286 · Vendor Advisory
• https://github.com/serenity-is/Serenity · Note
• http://seclists.org/fulldisclosure/2023/May/14 · Note
• https://t.me/cvenotify/109518 · Telegram Post
• http://packetstormsecurity.com/files/172648/Serenity-StartSharp-Software-File-Upload-XSS-User-Enumeration-Reusable-Tokens.html · Note