Windu CMS User Enumeration Vulnerability

A user enumeration vulnerability has been identified in Windu CMS version 4.1. During the login process, discrepancies in the response messages can reveal whether a login is valid, potentially allowing an attacker to conduct a brute force attack using valid credentials. While the vendor was notified of this vulnerability, they did not provide details on the affected version range. Only version 4.1 has been tested and confirmed vulnerable.

Impact

Exploitation of this vulnerability allows for user enumeration, enabling attackers to determine valid usernames and potentially use them in conjunction with password guessing attacks.