CyberRota Analysis
AI-GeneratedBudibase versions prior to 3.39.25 are vulnerable to an enumeration attack, allowing unauthenticated attackers to identify valid email addresses through the login failure response mechanism. This could lead to account lockouts for legitimate users, impacting user access and security. Organizations using affected versions should prioritize upgrading to 3.39.25 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Budibase is an open-source low-code platform. Prior to 3.39.25, POST /api/global/auth/:tenantId/login incremented the failure counter in packages/worker/src/api/controllers/global/auth.ts only for existing users, while packages/worker/src/middleware/emailLockout.ts returned X-Account-Locked and Retry-After only for locked identifiers. An unauthenticated attacker could compare the response after repeated failures to enumerate valid email addresses and temporarily lock valid accounts. This issue is fixed in version 3.39.25.