CVE-2023-39343mediumCWE-204

CVE-2023-39343: medium-severity vulnerability in sulu

Sulu Observable Response Discrepancy on Admin Login

Published · Updated

Follow this CVE+ Monitor sulu+ Monitor sulu/sulu

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 4.3epss 0.6%
Sulu is an open-source PHP content management system based on the Symfony framework. It allows over the Admin Login form to detect which user (username, email) exists and which one do not exist. Sulu Installation not using the old Symfony 5.4 security System and previous version are not impacted by this Security issue. The vulnerability has been patched in version 2.5.10.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected products
sulu · sulu
Related CVEs — sulu

In the same product, most dangerous first.

CVE-2021-43836HIGHPHP file inclusion in the Sulu admin panelEPSS 2.0%CVE-2021-43835HIGHPrivilege escalation in the Sulu Admin panelEPSS 1.2%CVE-2020-15132MEDIUMReset Password / Login vulnerability in SuluEPSS 1.1%CVE-2021-32737HIGHXSS Injection in Media Collection Title was possibleEPSS 0.7%CVE-2021-41169MEDIUMImproper Neutralization HTML tags in sulu/suluEPSS 0.6%CVE-2026-82394MEDIUMSulu: Fix authorization bypass when creating preview linksEPSS 0.6%