CVE-2026-25138mediumCWE-204

CVE-2026-25138: falha de média gravidade em rucio

Rucio WebUI has Username Enumeration via Login Error Message

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar rucio+ Monitorar rucio-webui

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.3epss 0.4%
Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies. Prior to versions 35.8.3, 38.5.4, and 39.3.1, the WebUI login endpoint returns distinct error messages depending on whether a supplied username exists, allowing unauthenticated attackers to enumerate valid usernames. Versions 35.8.3, 38.5.4, and 39.3.1 fix the issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Produtos afetados
rucio · rucio
CVEs relacionadas — rucio

No mesmo produto, das mais perigosas para as menos.

CVE-2026-58273HIGHRucio: Authorisation Bypass on REST API endpoint for signing URLsEPSS 0.6%CVE-2026-25736MEDIUMRucio WebUI has a Stored Cross-site Scripting (XSS) Vulnerability in its Custom RSE AttributeEPSS 0.3%CVE-2026-25735MEDIUMRucio WebUI has a Stored Cross-site Scripting (XSS) vulnerability its Identity NameEPSS 0.3%CVE-2026-25734MEDIUMRucio WebUI has Stored Cross-site Scripting (XSS) in RSE MetadataEPSS 0.3%CVE-2026-25136HIGHRucio WebUI has a Reflected Cross-site Scripting VulnerabilityEPSS 0.3%CVE-2026-25733HIGHRucio WebUI Vulnerable to Stored Cross-site Scripting (XSS) through Custom Rule FunctionEPSS 0.3%