CVE-2023-38871

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-09-28 · updated 2026-06-17
Weakness: CWE-203

Description

The commit 3730880 (April 2023) and v.0.9-beta1 of gugoan Economizzer has a user enumeration vulnerability in the login and forgot password functionalities. The app reacts differently when a user or email address is valid, and when it's not. This may allow an attacker to determine whether a user or email address is valid, or brute force valid usernames and email addresses.

Affected products

Economizzer: 0.9-beta1, april_2023

References

https://github.com/dub-flow/vulnerability-research/tree/main/CVE-2023-38871
https://github.com/gugoan/economizzer
https://www.economizzer.org
https://github.com/dub-flow/vulnerability-research/tree/main/CVE-2023-38871
https://github.com/gugoan/economizzer
https://www.economizzer.org

Get alerted when CVE-2023-38871 or the next vulnerability affects your stack