CVE-2021-44554 - CVE House
Back to Database
Status published Medium CVE-2021-44554

Thinfinity VirtualUI before 3.0 allows a malicious actor to enumerate...

Vulnerability Description

Thinfinity VirtualUI before 3.0 allows a malicious actor to enumerate users registered in the OS (Windows) through the /changePassword URI. By accessing the vector, an attacker can determine if a username exists thanks to the message returned; it can be presented in different languages according to the configuration of VirtualUI. Common users are administrator, admin, guest and krgtbt.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-44554

Credits & Attribution

No credits recorded in the NVD database.

References

More from cybelesoft

View All →
CVE-2021-46354
Thinfinity VirtualUI 2.1.28.0, 2.1.32.1 and 2.5.26.2, fixed in version 3.0...
High 7.5
CVE-2021-45092
Thinfinity VirtualUI before 3.0 has functionality in /lab.html reachable by...
Critical 9.8
CVE-2021-44848
In Cibele Thinfinity VirtualUI before 3.0, /changePassword returns different responses...
Medium 5.3
CVE-2019-16385
Cybele Thinfinity VirtualUI 2.5.17.2 allows HTTP response splitting via the...
Medium 6.1
CVE-2019-16384
Cybele Thinfinity VirtualUI 2.5.17.2 allows ../ path traversal that can...
Medium 6.5

Affected Vendor

Affected Software

thinfinity virtualui
Vulnerable Versions:
0

Timeline

Official Publish: December 20th, 2021
Last Modified: August 4th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.