UpHeron
All vulnerabilities

Servers and applications

CVE-2022-39314

User enumeration in the code-based login and password reset forms

Severity
Low 3.7
Published
18 Oct 2022
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
3.5.8.2, 3.6.6.2, 3.7.5.1
Also known as
GHSA-43qq-qw4x-28f8
Sources
NVD, Project advisories (GitHub)

Description

Kirby is a flat-file CMS. In versions prior to 3.5.8.2, 3.6.6.2, 3.7.5.1, and 3.8.1, Kirby is subject to user enumeration due to Improper Restriction of Excessive Authentication Attempts. This vulnerability affects you only if you are using the `code` or `password-reset` auth method with the `auth.methods` option or if you have enabled the `debug` option in production. By using two or more IP…

Affected software

SoftwareAffected versions
KirbyServers and applications · cpe:a:getkirby:kirby
  • Version 3.8.0
  • Version 3.8.0-rc3
  • Version 3.8.0-rc2
  • Version 3.8.0-rc1
All 7 release lines
  • Every version before 3.5.8.2
  • From 3.6.0 before 3.6.6.2
  • From 3.7.0 before 3.7.5.1
  • Version 3.8.0-rc1
  • Version 3.8.0-rc2
  • Version 3.8.0-rc3
  • Version 3.8.0
KirbyServers and applications · github:getkirby/kirby
  • Version 3.8.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2022-39314
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2022-39314
  • GitHub Advisory Database https://github.com/advisories/GHSA-43qq-qw4x-28f8
  • github.com https://github.com/getkirby/kirby/security/advisories/GHSA-43qq-qw4x-28f8