OpenAtlas User Enumeration Vulnerability

A user enumeration vulnerability has been identified in OpenAtlas version 8.12.0, developed by the Austrian Academy of Sciences. This vulnerability allows remote attackers to gather sensitive information by exploiting the login error messages, which differentiate between incorrect passwords and non-existent usernames. Such a distinction enables attackers to automate the process of verifying username validity, potentially facilitating brute-force attacks, credential stuffing, and phishing attempts.

Impact

Exploitation of this vulnerability allows for automated enumeration of valid usernames, which can be used to launch targeted attacks such as password guessing or phishing.

Remediation

Users are advised to update OpenAtlas to version 8.12.1, where this vulnerability has been fixed.