CVE-2023-40179 - CVE House
Back to Database
Status published Medium CVE-2023-40179

Silverware Games vulnerable to account enumeration via inconsistent responses

Vulnerability Description

Silverware Games is a premium social network where people can play games online. Prior to version 1.3.6, the Password Recovery form would throw an error if the specified email was not found in our database. It would only display the "Enter the code" form if the email is associated with a member of the site. Since version 1.3.6, the "Enter the code" form is always returned, showing the message "If the entered email is associated with an account, a code will be sent now". This change prevents potential violators from determining if our site has a user with the specified email.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-40179

Credits & Attribution

No credits recorded in the NVD database.

References

More from mesosoi

View All →
CVE-2023-40182
silverware-io-issue-tracker server responds in a noticeably different amount of time depending if a given email address exists or not
Low 3.7
CVE-2023-29192
SilverwareGames.io users with access to the game upload panel are able to edit download links for games uploaded by other developers
Low 2.7
CVE-2022-36072
SilverwareGames.io used == for hashing instead of ===
Medium 5.9
CVE-2022-23543
HTML attributes when attaching a YouTube link to the post
Medium 6.3

Affected Vendor

Affected Software

silverwaregames-io-issue-tracker
Vulnerable Versions:
< 1.3.6

Timeline

Official Publish: August 25th, 2023
Last Modified: October 2nd, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weaknesses (CWE)

CWE-204

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.