CVE-2022-32741

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Attacker is able to determine if the provided username exists (and it's valid) using Request New Password feature, based on the response time.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published
Jun 13, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-327424.3A flaw was found in Samba. Some SMB1 write requests were not correctly range-checked to ensure the client had sent enough data to fulfill thCVE-2022-327437.5Samba does not validate the Validated-DNS-Host-Name right for the dNSHostName attribute which could permit unprivileged users to write it.CVE-2022-327448.8A flaw was found in Samba. The KDC accepts kpasswd requests encrypted with any key known to it. By encrypting forged kpasswd requests with iCVE-2022-327458.1A flaw was found in Samba. Samba AD users can cause the server to access uninitialized data with an LDAP add or modify the request, usually CVE-2022-327465.4A flaw was found in the Samba AD LDAP server. The AD DC database audit logging module can access LDAP message values freed by a preceding daCVE-2022-327478.1A CWE-290: Authentication Bypass by Spoofing vulnerability exists that could cause legitimate users to be locked out of devices or facilitatCVE-2022-327488.3A CWE-295: Improper Certificate Validation vulnerability exists that could cause the CAE software to give wrong data to end users when usingCVE-2022-327497.5Improper Check for Unusual or Exceptional Conditions vulnerability handling requests in Apache Traffic Server allows an attacker to crash thCVE-2022-32759.8Command injection is possible in the puppetlabs-apt module prior to version 9.0.0. A malicious actor is able to exploit this vulnerability oCVE-2022-327505.4IBM DataPower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.8, 10.5.0.0, and 2018.4.1.0 through 2018.4.1.21 is vulnerable to crCVE-2022-327515.3IBM Security Verify Directory 10.0.0 could disclose sensitive server information that could be used in further attacks against the system. CVE-2022-327528.8IBM Security Directory Suite VA 8.0.1 through 8.0.1.19 could allow a remote authenticated attacker to execute arbitrary commands on the syst