CVE-2023-38871: Economizzer user enumeration vulnerability

September 28, 2023

The commit 3730880 (April 2023) and v.0.9-beta1 of gugoan Economizzer has a user enumeration vulnerability in the login and forgot password functionalities. The app reacts differently when a user or email address is valid, and when it’s not. This may allow an attacker to determine whether a user or email address is valid, or brute force valid usernames and email addresses.

References

github.com/advisories/GHSA-h3qf-v68r-35jg
github.com/dub-flow/vulnerability-research/tree/main/CVE-2023-38871
github.com/gugoan/economizzer
github.com/gugoan/economizzer/commit/37308802dfe00d43df396a8afaa2096ece8b7b57
nvd.nist.gov/vuln/detail/CVE-2023-38871
www.economizzer.org/

Code Behaviors & Features

Detect and mitigate CVE-2023-38871 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →