Information Disclosure

ezsystems/ezpublish-kernel is vulnerable to Information Disclosure. The /user/sessions endpoint allows an attacker to detect if a given username or email refers to a valid account through the differences in the response data or response time of certain requests...