Strix
26.1K

CVE-2022-39315

MEDIUMCVSS 5.3/10EPSS 0.58%

Last modified

CVE-2022-39315 is a medium-severity vulnerability rated 5.3/10 on the CVSS scale. Kirby is a Content Management System. Prior to versions 3.5.8.2, 3.6.6.2, 3.7.5.1, and 3.8.1, a user enumeration vulnerability affects all Kirby sites with user accounts unless Kirby's API and Panel are disabled in the config. EPSS estimates a 0.58% chance of exploitation in the next 30 days.

Description

Kirby is a Content Management System. Prior to versions 3.5.8.2, 3.6.6.2, 3.7.5.1, and 3.8.1, a user enumeration vulnerability affects all Kirby sites with user accounts unless Kirby's API and Panel are disabled in the config. It can only be exploited for targeted attacks because the attack does not scale to brute force. The problem has been patched in Kirby 3.5.8.2, Kirby 3.6.6.2, Kirby 3.7.5.1, and Kirby 3.8.1. In all of the mentioned releases, the maintainers have rewritten the affected code so that the delay is also inserted after the brute force limit is reached.

Metrics

CVSS 3.1
5.3/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS Probability
0.58%

43.5th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
GetkirbyKirby< 3.5.8.2
GetkirbyKirby>= 3.6.0, < 3.6.6.2
GetkirbyKirby>= 3.7.0, < 3.7.5.1
GetkirbyKirby3.8.0

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2022-39315?
Kirby is a Content Management System. Prior to versions 3.5.8.2, 3.6.6.2, 3.7.5.1, and 3.8.1, a user enumeration vulnerability affects all Kirby sites with user accounts unless Kirby's API and Panel are disabled in the config. It can only be exploited for targeted attacks because the attack does not scale to brute force. The problem has been patched in Kirby 3.5.8.2, Kirby 3.6.6.2, Kirby 3.7.5.1, and Kirby 3.8.1. In all of the mentioned releases, the maintainers have rewritten the affected code so that the delay is also inserted after the brute force limit is reached.
How severe is CVE-2022-39315?
CVE-2022-39315 has a CVSS score of 5.3/10 (MEDIUM severity). The EPSS model estimates a 0.58% probability of exploitation in the next 30 days.
How do I fix CVE-2022-39315?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2022-39315?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST