MantisBT - CDash
View Issue Details
IDProjectCategoryView StatusDate SubmittedLast Update
0013577CDashpublic2012-10-06 06:552012-10-18 03:17
ReporterJonnycake 
Assigned ToJulien Jomier 
PrioritynormalSeverityminorReproducibilityalways
StatusresolvedResolutionfixed 
PlatformOSOS Version
Product Version 
Target VersionFixed in Version2.2 
Summary0013577: User Enumeration Vulnerability
DescriptionUser enumeration would allow an attacker to discover emails in the database.
Steps To ReproduceInput valid username/valid password: functions as expected.
Input valid username/invalid password: displays "Wrong username or password."
Input invalid username: displays "This user doesn't exist."
Additional InformationQuick fix, just change the text you display when an invalid username is input to that of a valid username/invalid password.
TagsNo tags attached.
Relationships
Attached Files
Issue History
Date ModifiedUsernameFieldChange
2012-10-06 06:55JonnycakeNew Issue
2012-10-18 03:11Julien JomierAssigned To => Julien Jomier
2012-10-18 03:11Julien JomierStatusnew => assigned
2012-10-18 03:17Julien JomierNote Added: 0031256
2012-10-18 03:17Julien JomierStatusassigned => resolved
2012-10-18 03:17Julien JomierFixed in Version => 2.2
2012-10-18 03:17Julien JomierResolutionopen => fixed

Notes
(0031256)
Julien Jomier   
2012-10-18 03:17   
Thanks a lot for the report.