CVE-2019-6122

low-risk
Published 2019-11-06

A Username Enumeration via Error Message issue was discovered in NiceHash Miner before 2.0.3.0 because an "EMAIL DOES NOT EXIST" error message occurs whenever a submitted email address is incorrect, but there is a different error message for invalid credentials with a correct email address.

Do I need to act?

-
0.36% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
3
CVSS 3.1/10 Low
NETWORK / HIGH complexity

Affected Products (1)

Miner

Affected Vendors

Nicehash

References (4)

Exploit https://cyberworldmirror.com/nicehash-vulnerability-leaked-miners-information/
Exploit https://docs.google.com/document/d/1OubhuTRzuTMnkZ9SCFb8BtJVbTu840wDxyWu3VWHwvs/...
Exploit https://cyberworldmirror.com/nicehash-vulnerability-leaked-miners-information/
Exploit https://docs.google.com/document/d/1OubhuTRzuTMnkZ9SCFb8BtJVbTu840wDxyWu3VWHwvs/...
17
/ 100
low-risk
Severity 11/34 · Low
Exploitability 1/34 · Minimal
Exposure 5/34 · Minimal