CVE-2019-14351

CVE-2019-14351 describes a user password hash enumeration vulnerability in EspoCRM version 5.6.4. An authenticated attacker can exploit this flaw by crafting specific API requests to brute-force user password hashes one character at a time. This vulnerability carries a high CVSS score of 8.8, indicating a significant risk of compromise, as it allows for high confidentiality, integrity, and availability impact with low attack complexity. While no active exploitation, public exploit code, or significant community discussion has been observed, the potential for an attacker to gain unauthorized access to user accounts remains a concern.