CVE-2024-13028
Antabot White-Jotter login observable response discrepancy
In short
The login page of Antabot White-Jotter responds differently depending on whether a username exists or not, allowing attackers to discover valid usernames through the application's behavior.
Technical detail
This information disclosure vulnerability in the /login endpoint exhibits observable response discrepancy based on username input (CWE-203, CWE-204), enabling remote enumeration of valid accounts. Exploitation requires high attack complexity and is difficult to execute, but proof-of-concept code is publicly available.
Summary generated and translated by AI from the official description.
A vulnerability, which was classified as problematic, has been found in Antabot White-Jotter up to 0.2.2. This issue affects some unknown processing of the file /login. The manipulation of the argument username leads to observable response discrepancy. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used.
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
Antabot · White-JotterWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →