Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.3
CVE-2023-41885: Piccolo login can reveal existing usernames
CVE-2023-41885 · published 3 years ago
Summary
Versions of Piccolo up to 0.120.0 may let an attacker discover which user names are valid by measuring how long the login process takes. Knowing valid accounts makes it easier to try common passwords against them. Update Piccolo to version 0.121.0 or newer to stop this behavior.
What to do
- Update daniel townsend piccolo to version 0.121.0.
- Update piccolo-orm piccolo to version 0.121.0 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| pip | daniel townsend | piccolo |
<= 0.120.0 Fix: upgrade to 0.121.0
|
| – | piccolo-orm | piccolo |
< 0.121.0 cpe:2.3:a:piccolo-orm:piccolo:*:*:*:*:*:*:*:* |
Original advisory text
Piccolo's current `BaseUser.login` implementation is vulnerable to time based user enumeration
Piccolo is an ORM and query builder which supports asyncio. In versions 0.120.0 and prior, the implementation of `BaseUser.login` leaks enough information to a malicious user such that they would be able to successfully generate a list of valid users on the platform. As Piccolo on its own does not also enforce strong passwords, these lists of valid accounts are likely to be used in a password spray attack with the outcome being attempted takeover of user accounts on the platform. The impact of this vulnerability is minor as it requires chaining with other attack vectors in order to gain more then simply a list of valid users on the underlying platform. The likelihood of this vulnerability is possible as it requires minimal skills to pull off, especially given the underlying login functionality for Piccolo based sites is open source. This issue has been patched in version 0.121.0.
References
- https://github.com/pypa/advisory-database/tree/main/vulns/piccolo/PYSEC-2023-173...
- https://github.com/advisories/GHSA-h7cm-mrvq-wcfr
- https://github.com/piccolo-orm/piccolo/security/advisories/GHSA-h7cm-mrvq-wcfr Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2023-41885 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/41xxx/CVE-2023-41885... Vendor Advisory
- https://github.com/piccolo-orm/piccolo/commit/edcfe3568382922ba3e3b65896e6e7272f... Patch
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Type
CWE-203Observable Discrepancy
CWE-204Observable Response Discrepancy
Timeline
Published12 Sep 2023
Updated4 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta