CVE-2023-40182

Silverware Games is a premium social network where people can play games online. When using the Recovery form, a noticeably different amount of time passes depending of whether the specified email address presents in our database or not. This has been fixed in version 1.3.7.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/mesosoi/silverwaregames-io-issue-tracker/security/advisories/GHSA-9684-6j5x-ccx9	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:silverwaregames:silverwaregames:*:*:*:*:*:*:*:*

History

06 Sep 2023, 14:56

Type	Values Removed	Values Added
First Time		Silverwaregames silverwaregames Silverwaregames
CPE		cpe:2.3:a:silverwaregames:silverwaregames::::::::
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 5.3
References	~~(MISC) https://github.com/mesosoi/silverwaregames-io-issue-tracker/security/advisories/GHSA-9684-6j5x-ccx9 -~~	(MISC) https://github.com/mesosoi/silverwaregames-io-issue-tracker/security/advisories/GHSA-9684-6j5x-ccx9 - Third Party Advisory

25 Aug 2023, 03:55

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-08-25 01:15

Updated : 2023-12-10 15:14

NVD link : CVE-2023-40182

Mitre link : CVE-2023-40182

CVE.ORG link : CVE-2023-40182

JSON object : View

Products Affected

silverwaregames

silverwaregames

CWE

CWE-208

Observable Timing Discrepancy

{"id": "CVE-2023-40182", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.2}]}, "published": "2023-08-25T01:15:08.910", "references": [{"url": "https://github.com/mesosoi/silverwaregames-io-issue-tracker/security/advisories/GHSA-9684-6j5x-ccx9", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-208"}]}], "descriptions": [{"lang": "en", "value": "Silverware Games is a premium social network where people can play games online. When using the Recovery form, a noticeably different amount of time passes depending of whether the specified email address presents in our database or not. This has been fixed in version 1.3.7."}, {"lang": "es", "value": "Silverware Games es una red social premium donde la gente puede jugar a juegos en l\u00ednea. Al utilizar el formulario de recuperaci\u00f3n, pasa un tiempo notablemente diferente dependiendo de si la direcci\u00f3n de correo electr\u00f3nico especificada est\u00e1 o no en la base de datos. Esto se ha corregido en la versi\u00f3n 1.3.7. "}], "lastModified": "2023-09-06T14:56:27.160", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:silverwaregames:silverwaregames:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "76D6E7A5-2D55-4D0B-BF65-5BCB0522B90D", "versionEndExcluding": "1.3.7"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}