Skip to main content

Public

Project privacy set to public. By default, its content is available to everyone (authenticated or not). Please note that more restrictive permissions might exist on some items.

    •  
      request #43674 User enumeration via the lost password form
    Actions
    Infos
    #43674
    Thomas Gerbet (tgerbet)
    2025-07-22 14:46
    2025-06-20 11:40
    45364
    Details
    User enumeration via the lost password form

    Impact

    The forgot password form allows for user enumeration.
    CVSSv3.1 score: 5.3 ( CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

    References

    CWE 204
    Forgot Password - OWASP Cheat Sheet
    CVE-2025-52899

    Acknowledgements

    The issue has been identified by AlgoSecure penetration testing team during an audit sponsored by Enalean.

    Other
    All
    Empty
    • [ ] enhancement
    • [ ] internal improvement
    Empty
    Stage
    Antoine Sauzeau (antoinesauzeau)
    Closed
    2025-06-25
    Attachments
    Empty
    References
    Referencing request #43674

    Git commit

    tuleap/tuleap/stable

    fix(reset_password): request #43674 Don't return an error message if the account doesn't exist 5c72d6d253
    User avatar Antoine Sauzeau (antoinesauzeau) , 2025-06-25 10:51
    Merge 'gerrit #34764' into stable/master 1a89f2bed5
    User avatar Thomas Gerbet (tgerbet) , 2025-06-25 11:18
    feat: Add tests to ensure that the user enumeration vuln in the password reset form can't be reintroduced ee50d5ab3f
    User avatar Antoine Sauzeau (antoinesauzeau) , 2025-07-04 14:33
    Referenced by request #43674

    Artifact Tracker v5

    rel #43670 16.10
    Display settings

    Follow-ups

    User avatar
    Thomas Gerbet (tgerbet)2025-06-27 09:45

    CVE-2025-52899 has been assigned to this issue.

    • Original Submission
      Something went wrong, the follow up content couldn't be loaded
      Only formatting have been changed, you should switch to markup to see the changes
    User avatar
    Thomas Gerbet (tgerbet)2025-06-20 11:42
    • Original Submission
      Something went wrong, the follow up content couldn't be loaded
      Only formatting have been changed, you should switch to markup to see the changes