GHSA-wmwf-49vv-p3mr

Source

https://github.com/advisories/GHSA-wmwf-49vv-p3mr

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/08/GHSA-wmwf-49vv-p3mr/GHSA-wmwf-49vv-p3mr.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-wmwf-49vv-p3mr

Aliases

CVE-2023-39343

Published

2023-08-03T19:44:28Z

Modified

2024-02-16T08:14:08.539235Z

Severity

4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator

Summary

Sulu Observable Response Discrepancy on Admin Login

Details

Impact

It allows over the Admin Login form to detect which user (username, email) exists and which one do not exist.

Impacted by this issue are Sulu installation >= 2.5.0 and <2.5.10 using the newer Symfony Security System which is default since Symfony 6.0 but can be enabled in Symfony 5.4. Sulu Installation not using the old Symfony 5.4 security System and previous version are not impacted by this Security issue.

Patches

The problem has been patched in version 2.5.10.

Workarounds

Create a custom AuthenticationFailureHandler which does not return the $exception->getMessage(); instead the $exception->getMessageKey();

References

Currently no references.

Database specific

{
    "nvd_published_at": "2023-08-04T01:15:10Z",
    "cwe_ids": [
        "CWE-204"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2023-08-03T19:44:28Z"
}

References

Affected packages

Packagist / sulu/sulu

Package

Name: sulu/sulu
Purl: pkg:composer/sulu/sulu

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.5.0

Fixed

2.5.10

Affected versions

2.*

2.5.0

2.5.1

2.5.2

2.5.3

2.5.4

2.5.5

2.5.6

2.5.7

2.5.8

2.5.9