PT-2023-27308 · Unknown · Silverware Games

Mesosoi · Published 2023-08-25 · Updated 2023-08-30 · CVE-2023-40179

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Silverware Games versions prior to 1.3.6

Description The issue concerns the Password Recovery form in Silverware Games, a premium social network for online gaming. Prior to version 1.3.6, the form would indicate whether an email address is associated with a site member by throwing an error if the email was not found in the database. This behavior allowed potential attackers to determine if a specific email address is linked to a user account. Since version 1.3.6, the form always returns the "Enter the code" page, displaying a message that a code will be sent if the email is associated with an account, thus preventing attackers from identifying email addresses linked to user accounts.

Recommendations For versions prior to 1.3.6, update to version 1.3.6 or later to prevent potential violators from determining if the site has a user with a specified email.

Exploit

Fix

Weakness Enumeration

CWE-204

Related Identifiers

CVE-2023-40179

GHSA-789J-CHFJ-58HR

Affected Products

Silverware Games

References · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/40xxx/CVE-2023-40179.json · Exploit
• https://osv.dev/vulnerability/CVE-2023-40179 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-40179 · Security Note
• https://github.com/mesosoi/silverwaregames-io-issue-tracker/security/advisories/GHSA-789j-chfj-58hr · Note
• https://t.me/cvenotify/57258 · Telegram Post