CVE-2022-40084
First published: Thu Oct 20 2022(Updated: )
OpenCRX before v5.2.2 was discovered to be vulnerable to password enumeration due to the difference in error messages received during a password reset which could enable an attacker to determine if a username, email or ID is valid.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Opencrx Opencrx | <=5.2.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://cwe.mitre.org/data/definitions/204.html#:~:text=User%20enumeration%20via%20discrepancies%20in%20error%20messages.,-CVE%2D2004%2D0294&text=Bulletin%20Board%20displays%20different%20error,brute%20force%20password%20guessing%20attack.
- https://github.com/ciph0x01/OpenCRX-CVE/blob/main/CVE-2022-40084.md
- https://cwe.mitre.org/data/definitions/204.html#:~:text=User%20enumeration%20via%20discrepancies%20in%20error%20messages.%2C-CVE-2004-0294&text=Bulletin%20Board%20displays%20different%20error%2Cbrute%20force%20password%20guessing%20attack.
Frequently Asked Questions
What is CVE-2022-40084?
CVE-2022-40084 is a vulnerability in OpenCRX software that allows an attacker to determine if a username, email, or ID is valid through password enumeration.
What is the severity of CVE-2022-40084?
The severity of CVE-2022-40084 is medium with a CVSS score of 5.3.
How does CVE-2022-40084 work?
CVE-2022-40084 works by exploiting the differences in error messages received during a password reset process to determine the validity of a username, email, or ID.
Which version of OpenCRX is affected by CVE-2022-40084?
OpenCRX versions up to and including v5.2.2 are affected by CVE-2022-40084.
How can I fix CVE-2022-40084?
To fix CVE-2022-40084, users should update their OpenCRX software to version 5.2.2 or higher.
- collector/nvd-index
- agent/weakness
- agent/severity
- agent/references
- agent/author
- agent/tags
- agent/event
- agent/type
- agent/description
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- vendor/opencrx
- canonical/opencrx opencrx
- version/opencrx opencrx/5.2.2