CVE-2024-47059

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

When logging in with the correct username and incorrect weak password, the user receives the notification, that their password is too weak.

However when an incorrect username is provided alongside with a weak password, the application responds with ’Invalid credentials’ notification.

This difference could be used to perform username enumeration.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published
Sep 18, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-47066.4The WordPress + Microsoft Office 365 / Azure AD | LOGIN plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'CVE-2024-470606.5Zitadel is an open source identity management platform. In Zitadel, even after an organization is deactivated, associated projects, respectiCVE-2024-470618.3Plate is a javascript toolkit that makes it easier for you to develop with Slate, a popular framework for building text editors. One longstaCVE-2024-470628.8Navidrome is an open source web-based music collection server and streamer. Navidrome automatically adds parameters in the URL to SQL querieCVE-2024-470636.1Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. If a malicious CVAT user with CVE-2024-470646.1Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. If an attacker can trick a logCVE-2024-470656.5Meshtastic is an open source mesh networking solution. Prior to 2.5.1, traceroute responses from the remote node are not rate limited. GivenCVE-2024-470668.8Lobe Chat is an open-source artificial intelligence chat framework. Prior to version 1.19.13, server-side request forgery protection implemeCVE-2024-470676.1AList is a file list program that supports multiple storages. AList contains a reflected cross-site scripting vulnerability in helper.go. ThCVE-2024-470686.1Rollup is a module bundler for JavaScript. Versions prior to 2.79.2, 3.29.5, and 4.22.4 are susceptible to a DOM Clobbering vulnerability whCVE-2024-470696.1Oveleon Cookie Bar is a cookie bar is for the Contao Open Source CMS and allows a visitor to define cookie & privacy settings for the websitCVE-2024-47075.4The Materialis Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's materialis_contact_form shortcod
CVE-2024-47059: Medium severity, CVSS 4.3 | Vulnix