CVE-2019-19805

MEDIUM

MFScripts YetiShare 3.5.2-4.5.3 - Account Enumeration via Timing Discrepancy in Password Reset

Title source: llm
STIX 2.1

Description

_account_forgot_password.ajax.php in MFScripts YetiShare 3.5.2 through 4.5.3 takes a different amount of time to return depending on whether an email address is configured for the account name provided. This can be used by an attacker to enumerate accounts by guessing email addresses.

References (1)

Core 1

Scores

CVSS v3 5.3
EPSS 0.0099
EPSS Percentile 58.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Details

CWE
CWE-203
Status published
Products (1)
mfscripts/yetishare 3.5.2 - 4.5.3
Published Dec 30, 2019
Tracked Since Feb 18, 2026