CVE-2022-23172 - CVE House
Back to Database
Status published Medium CVE-2022-23172

Priority - Priority User Enumeration

Vulnerability Description

An attacker can access to "Forgot my password" button, as soon as he puts users is valid in the system, the system would issue a message that a password reset email had been sent to user. This way you can verify which users are in the system and which are not.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-23172

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • : Dudu Moyal - Sophtix Security LTD.

References

More from Priority

View All →
CVE-2025-55064
Priority - CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Medium 4.8
CVE-2025-55063
Priority - CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Medium 4.8
CVE-2025-55062
Priority - CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Medium 4.8
CVE-2025-55061
Priority - CWE-434 Unrestricted Upload of File with Dangerous Type
High 8.8
CVE-2025-55060
Priority - CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
Medium 6.1

Affected Vendor

Affected Software

Priority
Vulnerable Versions:
22.0

Timeline

Official Publish: July 6th, 2022
Last Modified: September 16th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.