← Zuruck zu CVEs
CVE-2026-25138
MEDIUM5.3
Beschreibung
Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies. Prior to versions 35.8.3, 38.5.4, and 39.3.1, the WebUI login endpoint returns distinct error messages depending on whether a supplied username exists, allowing unauthenticated attackers to enumerate valid usernames. Versions 35.8.3, 38.5.4, and 39.3.1 fix the issue.
CVE Details
CVSS v3.1 Bewertung5.3
SchweregradMEDIUM
CVSS VektorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
AngriffsvektorNETWORK
KomplexitatLOW
Erforderliche PrivilegienNONE
BenutzerinteraktionNONE
Veroffentlicht2/25/2026
Zuletzt geandert2/27/2026
Quellenvd
Honeypot-Sichtungen0
Betroffene Produkte
cern:rucio
Schwachen (CWE)
CWE-204
Referenzen
https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html#authentication-and-error-messages(security-advisories@github.com)
https://github.com/rucio/rucio/releases/tag/35.8.3(security-advisories@github.com)
https://github.com/rucio/rucio/releases/tag/38.5.4(security-advisories@github.com)
https://github.com/rucio/rucio/releases/tag/39.3.1(security-advisories@github.com)
https://github.com/rucio/rucio/security/advisories/GHSA-38wq-6q2w-hcf9(security-advisories@github.com)
https://github.com/rucio/rucio/security/advisories/GHSA-38wq-6q2w-hcf9(134c704f-9b21-4f2e-91b3-4a467353bcc0)
IOC Korrelationen
Keine Korrelationen erfasst
This product uses data from the NVD API but is not endorsed or certified by the NVD.