UpHeron
All vulnerabilities

Servers and applications

CVE-2022-39315

User enumeration in the brute force protection

Severity
Medium 5.3
Published
18 Oct 2022
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
3.5.8.2, 3.6.6.2, 3.7.5.1
Also known as
GHSA-c27j-76xg-6x4f
Sources
NVD, Project advisories (GitHub)

Description

Kirby is a Content Management System. Prior to versions 3.5.8.2, 3.6.6.2, 3.7.5.1, and 3.8.1, a user enumeration vulnerability affects all Kirby sites with user accounts unless Kirby's API and Panel are disabled in the config. It can only be exploited for targeted attacks because the attack does not scale to brute force. The problem has been patched in Kirby 3.5.8.2, Kirby 3.6.6.2, Kirby…

Affected software

SoftwareAffected versions
KirbyServers and applications · cpe:a:getkirby:kirby
  • Version 3.8.0
  • Version 3.8.0-rc3
  • Version 3.8.0-rc2
  • Version 3.8.0-rc1
All 7 release lines
  • Every version before 3.5.8.2
  • From 3.6.0 before 3.6.6.2
  • From 3.7.0 before 3.7.5.1
  • Version 3.8.0-rc1
  • Version 3.8.0-rc2
  • Version 3.8.0-rc3
  • Version 3.8.0
KirbyServers and applications · github:getkirby/kirby
  • Version 3.8.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2022-39315
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2022-39315
  • GitHub Advisory Database https://github.com/advisories/GHSA-c27j-76xg-6x4f
  • github.com https://github.com/getkirby/kirby/security/advisories/GHSA-c27j-76xg-6x4f