CVE-2017-5537

· N/AModified

← All CVEs

CVSS v3.1

N/A

EPSS

2.31%

Published

Mar 15, 2017

Modified

May 12, 2026

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

The password reset form in Weblate before 2.10.1 provides different error messages depending on whether the email address is associated with an account, which allows remote attackers to enumerate user accounts via a series of requests.

Weaknesses (CWE)

CWE-200

Affected Products (1)

weblate · weblatevulnerable

References (12)

http://www.openwall.com/lists/oss-security/2017/01/18/11

Mailing ListPatch

http://www.openwall.com/lists/oss-security/2017/01/20/1

Mailing ListPatch

http://www.securityfocus.com/bid/95676

Third Party AdvisoryVDB Entry

https://github.com/WeblateOrg/weblate/blob/weblate-2.10.1/docs/changes.rst

PatchRelease Notes

https://github.com/WeblateOrg/weblate/commit/abe0d2a29a1d8e896bfe829c8461bf8b391f1079

Patch

https://github.com/WeblateOrg/weblate/issues/1317

Issue TrackingPatch

http://www.openwall.com/lists/oss-security/2017/01/18/11

Mailing ListPatch

http://www.openwall.com/lists/oss-security/2017/01/20/1

Mailing ListPatch

http://www.securityfocus.com/bid/95676

Third Party AdvisoryVDB Entry

https://github.com/WeblateOrg/weblate/blob/weblate-2.10.1/docs/changes.rst

PatchRelease Notes

https://github.com/WeblateOrg/weblate/commit/abe0d2a29a1d8e896bfe829c8461bf8b391f1079

Patch

https://github.com/WeblateOrg/weblate/issues/1317

Issue TrackingPatch

KEV Catalog EPSS Scores Vendors All CVEs