CVE-2019-6120

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2019-11-06 · updated 2026-06-17
Weakness: CWE-770

Description

An issue was discovered in NiceHash Miner before 2.0.3.0. A missing rate limit while adding a wallet via Email address allows remote attackers to submit a large number of email addresses to identify valid ones. By exploiting this vulnerability with CVE-2019-6122 (Username Enumeration) an adversary can enumerate a large number of valid users' Email addresses.

Affected products

Nicehash Miner: before 2.0.3.0 — fixed in 2.0.3.0

How to fix

Upgrade to a fixed version: Nicehash Miner 2.0.3.0. Check the vendor advisory for mitigations.

References

https://cyberworldmirror.com/nicehash-vulnerability-leaked-miners-information/
https://docs.google.com/document/d/1OubhuTRzuTMnkZ9SCFb8BtJVbTu840wDxyWu3VWHwvs/edit
https://cyberworldmirror.com/nicehash-vulnerability-leaked-miners-information/
https://docs.google.com/document/d/1OubhuTRzuTMnkZ9SCFb8BtJVbTu840wDxyWu3VWHwvs/edit

Get alerted when CVE-2019-6120 or the next vulnerability affects your stack