Vulnerability · Published Jul 6, 2022 · Assigned by INCD
CVE-2022-23172Priority - Priority User Enumeration
Medium 5.5
In plain English
A medium-severity security flaw in Priority from Priority. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 39% of all known vulnerabilities).
Severity (CVSS 3.1)5.5Medium
Exploit odds (30 days)0.5%top 60.6% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
An attacker can access to "Forgot my password" button, as soon as he puts users is valid in the system, the system would issue a message that a password reset email had been sent to user. This way you can verify which users are in the system and which are not.
Affected products (as reported)
References
- https://www.gov.il/en/departments/faq/cve_advisories x_refsource_MISC