CVE-2023-31286
Medium
Description
An issue was discovered in Serenity Serene (and StartSharp) before 6.7.0. When a password reset request occurs, the server response leaks the existence of users. If one tries to reset a password of a non-existent user, an error message indicates that this user does not exist.
SeverityMedium
CVSS5.3
Exploit probability63. percentile1%
ProductSerenity Serene
PublishedApr 27, 2023
First seenApr 27, 2023
Weakness typeCWE-209CWE-209
How to fix
Update
- serenity serene6.7.0 or later
- serenity startsharp6.7.0 or later
- Serenity.Net.Core6.7.0 or later
- Serenity.Net.Web6.7.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| serenity serene | v < 6.7.0 | 6.7.0 |
| serenity startsharp | v < 6.7.0 | 6.7.0 |
| Serenity.Net.CoreNuGet | v < 6.7.0 | 6.7.0 |
| Serenity.Net.WebNuGet | v < 6.7.0 | 6.7.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.