CVE-2023-3897

MediumPublished

Bypassing CAPTCHA & Enumerating Usernames via Password Reset Page

Published: Jul 25, 2023
Updated: Feb 13, 2025
Assigning CNA: 42Gears
Evidence observed: Feb 19, 2024

Primary CVSS

5.3/ 10Medium

nvd · CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS probability estimate

3.1%

Low · next 30 days

Percentile: 87.4%
Model date: Oct 15, 2026

EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.

Summary

Username enumeration is possible through Bypassing CAPTCHA in On-premise SureMDM Solution on Windows deployment allows attacker to enumerate local user information via error message. This issue affects SureMDM On-premise: 6.31 and below version

Sources

CVE-2023-3897PoC
Exploit for CVE-2023-3897 enabling username enumeration via CAPTCHA bypass in On-premise SureMDM on Windows. Includes PoC script for local user information disclosure.
SureMDM On-premise < 6.31 - CAPTCHA Bypass User EnumerationExploit
Jonas Benjamin Friedli · multiple · Feb 19, 2024

Responsible use

Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.