{"id":"CVE-2021-39189","published":"2021-09-15T13:50:13Z","modified":"2024-08-04T01:58:18Z","title":"Observable Response Discrepancy in Lost Password Service","vendor":"pimcore","product":"pimcore","tier":"tail","description":{"text":"Pimcore is an open source data & experience management platform. In versions prior to 10.1.3, it is possible to enumerate usernames via the forgot password functionality. This issue is fixed in version 10.1.3. As a workaround, one may apply the available patch manually.","provenance":"source","from":"CVE.org"},"cvss":{"score":5.3,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.01367,"percentile":0.71789,"provenance":"source"},"cwes":[{"id":"CWE-204","name":"Observable Response Discrepancy"}],"references":[{"url":"https://github.com/pimcore/pimcore/security/advisories/GHSA-579x-cjvr-cqj9","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/pimcore/pimcore/pull/10223.patch","tags":["x_refsource_MISC"]},{"url":"https://github.com/pimcore/pimcore/pull/10223/commits/d0a4de39cf05dce6af71f8ca039132bdfcbb0dce","tags":["x_refsource_MISC"]},{"url":"https://huntr.dev/bounties/12462a99-ebf8-4e39-80b3-54a16caa3f4c/","tags":["x_refsource_MISC"]}],"priority":{"score":18.1,"factors":[{"name":"EPSS percentile","points":14.36},{"name":"CVSS severity","points":3.71}]},"vendorSlug":"pimcore","affectedVersions":[{"vendor":"pimcore","product":"pimcore","versions":["< 10.1.3"]}],"affected":[{"ecosystem":"Packagist","package":"pimcore/pimcore","vulnerableRanges":["<10.1.3"],"patched":["10.1.3"],"from":["GHSA-579x-cjvr-cqj9"],"provenance":"source"}],"euvd":{"id":"EUVD-2021-1981","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-pimcore-cve-2019-18985","parents":[{"from":"CVE-2019-18985","to":"CVE-2021-39189","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["bundles/AdminBundle/Controller/Admin/LoginController.php"],"commits":["https://github.com/pimcore/pimcore/commit/9f2d075243a8392c114d9a8028858b9faf041e2d","https://github.com/pimcore/pimcore/commit/d0a4de39cf05dce6af71f8ca039132bdfcbb0dce"],"basis":"rarely changed file"}]}],"children":[{"from":"CVE-2021-39189","to":"CVE-2021-4082","relation":"successor","confidence":"high","kind":"lineage","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:pimcore/pimcore","fromFixed":"10.1.3","toFixed":"10.2.6","daysApart":86},{"kind":"same-code","provenance":"machine","files":["bundles/AdminBundle/Controller/Admin/LoginController.php"],"commits":["https://github.com/pimcore/pimcore/commit/d0a4de39cf05dce6af71f8ca039132bdfcbb0dce","https://github.com/pimcore/pimcore/commit/3088cec7dc3cbc5a8b26f1269e398e799ee7ee28"],"basis":"rarely changed file"}]}],"packageHistory":[{"cve":"CVE-2021-37702","published":"2021-08-18","fixed":"10.1.1","kev":false},{"cve":"CVE-2021-39166","published":"2021-09-01","fixed":"10.1.2","kev":false},{"cve":"CVE-2021-39170","published":"2021-09-01","fixed":"10.1.2","kev":false,"link":{"from":"CVE-2021-39170","to":"CVE-2021-39189","relation":"successor","confidence":"medium","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:pimcore/pimcore","fromFixed":"10.1.2","toFixed":"10.1.3","daysApart":14},{"kind":"similar","provenance":"machine","score":0.53,"basis":"same product + description similarity"}]}},{"cve":"CVE-2021-39189","published":"2021-09-15","fixed":"10.1.3","kev":false},{"cve":"CVE-2021-4081","published":"2021-12-10","fixed":"10.2.6","kev":false,"link":{"from":"CVE-2021-39189","to":"CVE-2021-4081","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:pimcore/pimcore","fromFixed":"10.1.3","toFixed":"10.2.6","daysApart":86}]}},{"cve":"CVE-2021-4082","published":"2021-12-10","fixed":"10.2.6","kev":false},{"cve":"CVE-2021-4084","published":"2021-12-10","fixed":"10.2.6","kev":false,"link":{"from":"CVE-2021-39189","to":"CVE-2021-4084","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:pimcore/pimcore","fromFixed":"10.1.3","toFixed":"10.2.6","daysApart":86}]}}],"package":"Packagist:pimcore/pimcore"}}