PYSEC-2017-42
See a problem?- Import Source
- https://github.com/pypa/advisory-database/blob/main/vulns/weblate/PYSEC-2017-42.yaml
- JSON Data
- https://api.test.osv.dev/v1/vulns/PYSEC-2017-42
- Aliases
- Published
- 2017-03-15T15:59:00Z
- Modified
- 2026-06-10T17:31:00Z
- Summary
- [none]
- Details
-
The password reset form in Weblate before 2.10.1 provides different error messages depending on whether the email address is associated with an account, which allows remote attackers to enumerate user accounts via a series of requests.
- References
-
- https://github.com/WeblateOrg/weblate/issues/1317
- https://github.com/WeblateOrg/weblate/commit/abe0d2a29a1d8e896bfe829c8461bf8b391f1079
- https://github.com/WeblateOrg/weblate/blob/weblate-2.10.1/docs/changes.rst
- http://www.securityfocus.com/bid/95676
- http://www.openwall.com/lists/oss-security/2017/01/20/1
- http://www.openwall.com/lists/oss-security/2017/01/18/11
- https://github.com/advisories/GHSA-j24g-gm76-j829
Affected packages
PyPI / weblate
Package
- Name
- weblate
- View open source insights on deps.dev
- Purl
- pkg:pypi/weblate
Affected ranges
- Type
- GIT
- Repo
- https://github.com/WeblateOrg/weblate
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixed
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed2.10.1
Affected versions
weblate-0.*
weblate-0.1
weblate-0.2
weblate-0.3
weblate-0.5
weblate-0.6
weblate-0.8
weblate-0.9
weblate-1.*
weblate-1.0
weblate-1.1
weblate-1.2
weblate-1.3
weblate-1.4
weblate-1.5
weblate-1.6
weblate-1.7
weblate-1.8
weblate-1.9
weblate-2.*
weblate-2.1
weblate-2.2
weblate-2.3
weblate-2.4
weblate-2.5
weblate-2.7
weblate-2.8
weblate-2.9
weblate-2.10
1.*
1.9
2.*
2.0
2.1
2.2
2.3
2.4
2.5
2.6
2.7
2.8
2.9
2.10