CVE-2019-19805

_account_forgot_password.ajax.php in MFScripts YetiShare 3.5.2 through 4.5.3 takes a different amount of time to return depending on whether an email address…

published December 30, 2019

CVSS
—
EPSS
1%
Percentile
62.2
In the wild
Unconfirmed
What it is

_account_forgot_password.ajax.php in MFScripts YetiShare 3.5.2 through 4.5.3 takes a different amount of time to return depending on whether an email address is configured for the account name provided. This can be used by an attacker to enumerate accounts by guessing email addresses.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00993 · 62.2th percentile
Published
2019-12-30T17:05Z
EPSS history
Timeline
  • 30 DEC 17:05Z
    _account_forgot_password.ajax.php in MFScripts YetiShare 3.5.2 through 4.5.3 takes a different amount of time to return depending on whether an email address…
    cvelistv5