WS-2022-0348

Date: September 11, 2022

requarks/wiki before 2.5.288 is vulnerable to User Enumeration via Response Timing. A computationally expensive hash function is only executed when the username is valid. If the username is invalid, the hash function is not executed, resulting in a difference in response timing. This allows an attacker to identify valid usernames and further attacks such as brute force attacks on valid accounts.

Language: JS