CVE-2019-7550

In JForum 2.1.8, an unauthenticated, remote attacker can enumerate whether a user exists by using the "create user" function. If a register/check/username?username= request corresponds to a username that exists, then an "is already in use" error is produced. NOTE: this product is discontinued...

CVE-2019-7550

CVE-2019-7550 concerns JForum 2.1.8, where an unauthenticated remote attacker can enumerate existing users by invoking the create user flow via a register/check/username?username= request. A positive match yields an “is already in use” error, indicating user existence. This is an information-disc...