PolarLearn is a free and open-source learning program. In 0-PRERELEASE-15 and earlier, a timing attack vulnerability in the sign-in process allows unauthenticated attackers to determine if a specific email address is registered on the platform. By measuring the response time of the login endpoint, an attacker can distinguish between valid and invalid email addresses. This occurs because the server only performs the computationally expensive Argon2 password hashing if the user exists in the database. Requests for existing users take significantly longer (~650ms) than requests for non-existent users (~160ms).
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XPolarlearn
APPPolarlearnall versions
Related vulnerabilities
PolarLearn: Pominięcie weryfikacji hasła przy logowaniu zbanowanych kont
PolarLearn: brak uwierzytelnienia w WebSocket czatu grupowego
PolarLearn is a free and open-source learning program. In 0-PRERELEASE-14 and earlier, setCustomPassword(userI...
PolarLearn is a free and open-source learning program. Prior to version 0-PRERELEASE-15, the vote API route (`...
PolarLearn to darmowy program edukacyjny o otwartym kodzie źródłowym. W wersji 0-PRERELEASE-15 i wcześniejszyc...