Sulu Observable Response Discrepancy on Admin Login
Impact
It allows over the Admin Login form to detect which user (username, email) exists and which one do not exist.
Impacted by this issue are Sulu installation >= 2.5.0 and <2.5.10 using the newer Symfony Security System which is default since Symfony 6.0 but can be enabled in Symfony 5.4. Sulu Installation not using the old Symfony 5.4 security System and previous version are not impacted by this Security issue.
Patches
The problem has been patched in version 2.5.10.
Workarounds
Create a custom AuthenticationFailureHandler which does not return the $exception->getMessage(); instead the $exception->getMessageKey();
References
Currently no references.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Composer package | sulu/sulu | >= 2.5.0, < 2.5.10 | 2.5.10 |
References
- https://github.com/sulu/sulu/security/advisories/GHSA-wmwf-49vv-p3mr
- https://nvd.nist.gov/vuln/detail/CVE-2023-39343
- https://github.com/sulu/sulu/commit/5f6c98ba030b2005793e2dc647cc938937ea889b
- https://github.com/FriendsOfPHP/security-advisories/blob/master/sulu/sulu/CVE-2023-39343.yaml
- https://github.com/sulu/sulu
- https://github.com/sulu/sulu/releases/tag/2.5.10
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N- Weakness (CWE)
CWE-204- Platform
- Composer
- Package
sulu/sulu- Disclosed
- 03.08.2023
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-wmwf-49vv-p3mr - CC BY 4.0
Vulnerability history: sulu/sulu
All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 18
- First → latest
- 08.2020 09.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 2
- Medium 14
- Low 2
Disclosures per year
- 2020: 1
- 2021: 4
- 2022: 0
- 2023: 1
- 2024: 4
- 2025: 1
- 2026: 7
-
Sulu Observable Response Discrepancy on Admin Login this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.