OpenCRX before v5.2.2 was discovered to be vulnerable to password enumeration due to the difference in error messages received during a password reset which could enable an attacker to determine if a username, email or ID is valid.
{ "nvd_published_at": "2022-10-20T14:15:00Z", "github_reviewed_at": "2022-10-24T18:51:43Z", "severity": "MODERATE", "github_reviewed": true, "cwe_ids": [ "CWE-203" ] }