CVE-2023-31286

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-04-27 · updated 2026-06-17
Weakness: CWE-209

Description

An issue was discovered in Serenity Serene (and StartSharp) before 6.7.0. When a password reset request occurs, the server response leaks the existence of users. If one tries to reset a password of a non-existent user, an error message indicates that this user does not exist.

Affected products

Serenity Serene: before 6.7.0 — fixed in 6.7.0
Serenity Startsharp: before 6.7.0 — fixed in 6.7.0

How to fix

Upgrade to a fixed version: Serenity Serene 6.7.0; Serenity Startsharp 6.7.0. Check the vendor advisory for mitigations.

References

http://packetstormsecurity.com/files/172648/Serenity-StartSharp-Software-File-Upload-XSS-User-Enumeration-Reusable-Tokens.html
http://seclists.org/fulldisclosure/2023/May/14
https://github.com/serenity-is/Serenity/commit/11b9d267f840513d04b4f4d4876de7823a6e48d2
http://packetstormsecurity.com/files/172648/Serenity-StartSharp-Software-File-Upload-XSS-User-Enumeration-Reusable-Tokens.html
http://seclists.org/fulldisclosure/2023/May/14
https://github.com/serenity-is/Serenity/commit/11b9d267f840513d04b4f4d4876de7823a6e48d2
https://seclists.org/fulldisclosure/2023/May/14

Get alerted when CVE-2023-31286 or the next vulnerability affects your stack