id: PYSEC-2017-42
details: The password reset form in Weblate before 2.10.1 provides different error
  messages depending on whether the email address is associated with an account, which
  allows remote attackers to enumerate user accounts via a series of requests.
affected:
- package:
    name: weblate
    ecosystem: PyPI
    purl: pkg:pypi/weblate
  ranges:
  - type: GIT
    repo: https://github.com/WeblateOrg/weblate
    events:
    - introduced: "0"
    - fixed: abe0d2a29a1d8e896bfe829c8461bf8b391f1079
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 2.10.1
  versions:
  - "1.9"
  - "2.0"
  - "2.1"
  - "2.10"
  - "2.2"
  - "2.3"
  - "2.4"
  - "2.5"
  - "2.6"
  - "2.7"
  - "2.8"
  - "2.9"
references:
- type: REPORT
  url: https://github.com/WeblateOrg/weblate/issues/1317
- type: FIX
  url: 
    https://github.com/WeblateOrg/weblate/commit/abe0d2a29a1d8e896bfe829c8461bf8b391f1079
- type: WEB
  url: https://github.com/WeblateOrg/weblate/blob/weblate-2.10.1/docs/changes.rst
- type: WEB
  url: http://www.securityfocus.com/bid/95676
- type: WEB
  url: http://www.openwall.com/lists/oss-security/2017/01/20/1
- type: WEB
  url: http://www.openwall.com/lists/oss-security/2017/01/18/11
- type: ADVISORY
  url: https://github.com/advisories/GHSA-j24g-gm76-j829
aliases:
- CVE-2017-5537
- GHSA-j24g-gm76-j829
modified: "2021-07-05T00:01:28.288013Z"
published: "2017-03-15T15:59:00Z"