CVEs-PoC/2021/CVE-2021-44848.md

CVE-2021-44848

Description

In Cibele Thinfinity VirtualUI before 3.0, /changePassword returns different responses for invalid authentication requests depending on whether the username exists.

POC

Reference

• http://packetstormsecurity.com/files/165327/Cibele-Thinfinity-VirtualUI-2.5.41.0-User-Enumeration.html
• https://github.com/cybelesoft/virtualui/issues/1

Github

• https://github.com/20142995/nuclei-templates
• https://github.com/ARPSyndicate/cve-scores
• https://github.com/ARPSyndicate/cvemon
• https://github.com/ARPSyndicate/kenzer-templates
• https://github.com/danielmofer/nuclei_templates
• https://github.com/dnlmrls/nuclei_templates