CVE-2021-44848
43Vexday Risk Score
Patch soon. It has a working public exploit.
ssvc Attendepss 23%
from disclosure to weapon3 days
Published on NVDDec 13
1st PoC+3d
exploitation probability
23%top 2% of all CVEs
observed exploitation
nono source reports it
2 public exploit(s)
In Cibele Thinfinity VirtualUI before 3.0, /changePassword returns different responses for invalid authentication requests depending on whether the username exists.
Affected products
n/a · n/apublic PoCs found — 2
exploitdbwww.exploit-db.com/exploits/50601unverifiedcve_referencepacketstormsecurity.com/files/165327/Cibele-Thinfinity-VirtualUI-2.5.41.0-User-Enumeration.htmlunverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.