CVE-2018-1000549 - Wekan version 1.04.0 contains a Email / Username Enumeration vulnerability in Register' and 'Forgot your password?' pages that can result in A remote attacker could perform a brute force attack to obtain valid usernames and email addresses.

Back Back to CVE browser

MEDIUM

Wekan version 1.04.0 contains a Email / Username Enumeration vulnerability in Register' and 'Forgot your password?' pages that can result in A remote attacker could perform a brute force attack to obtain valid usernames and email addresses.

Published Jun 26, 2018

5.3

MEDIUM

CVSS 3.0

EPSS 1.30%

Description

Wekan version 1.04.0 contains a Email / Username Enumeration vulnerability in Register' and 'Forgot your password?' pages that can result in A remote attacker could perform a brute force attack to obtain valid usernames and email addresses.. This attack appear to be exploitable via HTTP Request.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-200

Exposure of Sensitive Information

References (4)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-1938
Advisory
https://raw.githubusercontent.com/distributedweaknessfiling/cvelist/master/2018/1000xxx/CVE-2018-1000549.json
x_refsource_MISC
https://shadow-vault.com/wekan.html
x_refsource_MISCThird Party Advisory
https://wekan.github.io/hall-of-fame/brutebleed/
x_refsource_MISC

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-1938		Advisory
https://raw.githubusercontent.com/distributedweaknessfiling/cvelist/master/2018/1000xxx/CVE-2018-1000549.json		x_refsource_MISC
https://shadow-vault.com/wekan.html		x_refsource_MISCThird Party Advisory
https://wekan.github.io/hall-of-fame/brutebleed/		x_refsource_MISC