CVE-2024-34336

User enumeration vulnerability in ORDAT FOSS-Online before v2.24.01 allows attackers to determine if an account exists in the application by comparing the server responses of the forgot password functionality.
Configurations

Configuration 1 (hide)

cpe:2.3:a:ordat:ordat.erp:*:*:*:*:*:*:*:*

History

18 Sep 2024, 20:32

Type Values Removed Values Added
References () http://foss-online.com - () http://foss-online.com - Broken Link
References () http://ordat.com - () http://ordat.com - Product
References () https://mind-bytes.de/offenlegung-existierender-benutzerkonten-in-foss-online-cve-2024-34336/ - () https://mind-bytes.de/offenlegung-existierender-benutzerkonten-in-foss-online-cve-2024-34336/ - Exploit, Technical Description
Summary
  • (es) La vulnerabilidad de enumeración de usuarios en ORDAT FOSS-Online anterior a v2.24.01 permite a los atacantes determinar si existe una cuenta en la aplicación comparando las respuestas del servidor de la funcionalidad de contraseña olvidada.
First Time Ordat
Ordat ordat.erp
CWE CWE-203
CPE cpe:2.3:a:ordat:ordat.erp:*:*:*:*:*:*:*:*

12 Sep 2024, 20:35

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown
v2 : unknown
v3 : 5.3
CWE CWE-204

12 Sep 2024, 19:15

Type Values Removed Values Added
New CVE

Information

Published : 2024-09-12 19:15

Updated : 2024-09-18 20:32


NVD link : CVE-2024-34336

Mitre link : CVE-2024-34336

CVE.ORG link : CVE-2024-34336


JSON object : View

Products Affected

ordat

  • ordat.erp
CWE
CWE-203

Observable Discrepancy

CWE-204

Observable Response Discrepancy