CVE-2026-25138

Katalog CVE

CVSS 5.3 · Medium EPSS 0,33%

Kerentanan Observable Response Discrepancy pada cern rucio. Skor CVSS 3.1 5.3 (Medium) menurut github.com.

Deskripsi (NVD)

Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies. Prior to versions 35.8.3, 38.5.4, and 39.3.1, the WebUI login endpoint returns distinct error messages depending on whether a supplied username exists, allowing unauthenticated attackers to enumerate valid usernames. Versions 35.8.3, 38.5.4, and 39.3.1 fix the issue.

Rincian

Terbit di NVD

25 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.3 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-204: Observable Response Discrepancy

EPSS (30 hari)

0,33% peluang dieksploitasi; lebih tinggi dari 24,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/rucio/rucio/security/advisories/GHSA-38wq-6q2w-hcf9 exploit · advisory vendor
• https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html#authentication-and-error-messag... not applicable
• https://github.com/rucio/rucio/releases/tag/35.8.3 product · release notes
• https://github.com/rucio/rucio/releases/tag/38.5.4 product · release notes
• https://github.com/rucio/rucio/releases/tag/39.3.1 product · release notes