CVE-2017-5537

MEDIUM

Weblate < 2.10.1 - User Enumeration via Password Reset Error Messages

Title source: llm
STIX 2.1

Description

The password reset form in Weblate before 2.10.1 provides different error messages depending on whether the email address is associated with an account, which allows remote attackers to enumerate user accounts via a series of requests.

References (6)

Core 6
Core References
Mailing List, Patch mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2017/01/18/11
Issue Tracking, Patch x_refsource_confirm
https://github.com/WeblateOrg/weblate/issues/1317
Mailing List, Patch mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2017/01/20/1
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/95676

Scores

CVSS v3 5.3
EPSS 0.0229
EPSS Percentile 80.9%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Details

CWE
CWE-200
Status published
Products (2)
pypi/weblate 0 - 2.10.1PyPI
weblate/weblate < 2.10
Published Mar 15, 2017
Tracked Since Feb 18, 2026