CVE-2020-14016
Medium
Description
An issue was discovered in Navigate CMS 2.9 r1433. The forgot-password feature allows users to reset their passwords by using either their username or the email address associated with their account. However, the feature returns a not_found message when the provided username or email address does not match a user in the system. This can be used to enumerate users.
SeverityMedium
CVSS5.3
Exploit probability76. percentile1.6%
ProductNaviwebs Navigate Cms
PublishedJun 24, 2020
First seenJun 24, 2020
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| naviwebs navigate_cms | 2.9 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.