CyberRota Analysis
AI-GeneratedThe vulnerability in novel-plus versions up to 5.3.3 allows authenticated attackers to access sensitive user information, including password hashes, email addresses, and phone numbers, through the improperly secured /sys/user/list endpoint. This information disclosure could lead to offline hash cracking and potential account takeovers. Organizations utilizing affected versions should prioritize remediation to protect user data and prevent unauthorized access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
novel-plus through 5.3.3 contains an information disclosure vulnerability in the /sys/user/list endpoint that lacks proper permission annotations. Authenticated attackers can retrieve password hashes and personal data including email addresses and phone numbers for users within their data scope, enabling offline hash cracking and account takeover.