weblateorg/weblate · Security
Weblate user account enumeration via reset password form
- GHSA ID
- GHSA-j24g-gm76-j829
- CVE ID
- CVE-2017-5537
- Severity
- medium
- Published
- Updated
- CVSS
- 5.3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- CVSS v3
- 5.3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- CVSS v4
- 6.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Description
The password reset form in Weblate before 2.10.1 provides different error messages depending on whether the email address is associated with an account, which allows remote attackers to enumerate user accounts via a series of requests.
CWEs
- CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
- CWE-209 · Generation of Error Message Containing Sensitive Information
References
- https://nvd.nist.gov/vuln/detail/CVE-2017-5537 ↗
- https://github.com/WeblateOrg/weblate/issues/1317 ↗
- https://github.com/WeblateOrg/weblate/commit/abe0d2a29a1d8e896bfe829c8461bf8b391f1079 ↗
- https://github.com/WeblateOrg/weblate/blob/weblate-2.10.1/docs/changes.rst ↗
- http://www.openwall.com/lists/oss-security/2017/01/18/11 ↗
- http://www.openwall.com/lists/oss-security/2017/01/20/1 ↗
- http://www.securityfocus.com/bid/95676 ↗
- https://github.com/pypa/advisory-database/tree/main/vulns/weblate/PYSEC-2017-42.yaml ↗
- https://github.com/advisories/GHSA-j24g-gm76-j829 ↗