What is CVE-2022-34530?

CVE-2022-34530 is a medium-severity vulnerability in Backdropcms Backdrop_cms, classified under Weak Password Recovery Mechanism for Forgotten Password. CVSS score: 5.3/10. Published 2022-08-01.

How severe is CVE-2022-34530?

Medium severity. CVSS v3 base score is 5.3 out of 10.

Vulnerability in Backdropcms Backdrop_cms

CVE-2022-34530

An issue in the login and reset password functionality of Backdrop CMS v1.22.0 allows attackers to enumerate usernames via password reset requests and distinct responses returned based on usernames.

EPSS: 0.005 (41.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.

Affected products

Backdropcms Backdrop_cms
N/a — versions n/a

Weakness classification (CWE)

CWE-640 — Weak Password Recovery Mechanism for Forgotten Password

References

cve@mitre.org (Third Party Advisory, x_refsource_MISC)
af854a3a-2127-422b-91ae-364da2661108 (x_refsource_MISC, Not Applicable)

Frequently asked questions

What is CVE-2022-34530?: CVE-2022-34530 is a medium-severity vulnerability in Backdropcms Backdrop_cms, classified under Weak Password Recovery Mechanism for Forgotten Password. CVSS score: 5.3/10. Published 2022-08-01.
How severe is CVE-2022-34530?: Medium severity. CVSS v3 base score is 5.3 out of 10.