CVE-2023-39343
Sulu Observable Response Discrepancy on Admin Login
描述
### Impact It allows over the Admin Login form to detect which user (username, email) exists and which one do not exist. Impacted by this issue are Sulu installation >= 2.5.0 and <2.5.10 using the newer Symfony Security System which is default since Symfony 6.0 but can be enabled in Symfony 5.4. Sulu Installation not using the old Symfony 5.4 security System and previous version are not impacted by this Security issue. ### Patches The problem has been patched in version 2.5.10. ### Workarounds Create a custom AuthenticationFailureHandler which does not return the `$exception->getMessage();` instead the `$exception->getMessageKey();` ### References Currently no references.
如何修補 CVE-2023-39343
要修補 CVE-2023-39343,請將受影響套件升級到下列已修補版本。
- —升級至 2.5.10 或更新版本
CVE-2023-39343 正在被利用嗎?
低 — EPSS 為 0.5%,目前沒有觀察到大規模利用活動。
受影響套件(1)
- >= 2.5.0, < 2.5.10
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 3.1 | MEDIUM4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |