CVE Catalog
CVE-2024-34336
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk0.39%
31th percentile - higher than 31% of all known CVEs
Summary
User enumeration vulnerability in ORDAT FOSS-Online before v2.24.01 allows attackers to determine if an account exists by comparing server responses from the forgot password functionality.
Risk Assessment
The risk is that an attacker can compile a list of valid user accounts, which can be used for further attacks such as phishing or brute-force password attempts.
Recommendation
Immediately update ORDAT FOSS-Online to version 2.24.01 or later, which fixes this vulnerability.
Original NVD description (English source)
User enumeration vulnerability in ORDAT FOSS-Online before v2.24.01 allows attackers to determine if an account exists in the application by comparing the server responses of the forgot password functionality.