CVE-2021-44692

{"id": "CVE-2021-44692", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2022-01-26T16:15:07.570", "references": [{"url": "https://www.buddyboss.com/resources/buddyboss-platform-releases/", "tags": ["Release Notes", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.cygenta.co.uk/post/buddyboss", "tags": ["Mitigation", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "BuddyBoss Platform through 1.8.0 allows remote attackers to obtain the email address of each user. When creating a new user, it generates a Unique ID for their profile. This UID is their private email address with symbols removed and periods replaced with hyphens. For example. JohnDoe@example.com would become /members/johndoeexample-com and Jo.test@example.com would become /members/jo-testexample-com. The members list is available to everyone and (in a default configuration) often without authentication. It is therefore trivial to collect a list of email addresses."}, {"lang": "es", "value": "La plataforma BuddyBoss versiones hasta 1.8.0, permite a atacantes remotos obtener la direcci\u00f3n de correo electr\u00f3nico de cada usuario. Cuando es creado un nuevo usuario, es generado un ID \u00fanico para su perfil. Este UID es su direcci\u00f3n de correo electr\u00f3nico privada con los s\u00edmbolos eliminados y los puntos sustituidos por guiones. Por ejemplo. JohnDoe@example.com podr\u00eda ser convertido en /members/johndoeexample-com y Jo.test@example.com en /members/jo-testexample-com. La lista de miembros est\u00e1 disponible para todos y (en una configuraci\u00f3n por defecto) a menudo sin autenticaci\u00f3n. Por lo tanto, es trivial recopilar una lista de direcciones de correo electr\u00f3nico"}], "lastModified": "2022-02-02T15:57:59.923", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:buddyboss:buddyboss:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F6C71BB4-0D91-4902-A832-3FB3EE3C2C31", "versionEndIncluding": "1.8.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}