CVE-2024-34336 describes a user enumeration vulnerability in ORDAT FOSS-Online before version 2.24.01. Attackers can exploit differences in server responses during the forgot password process to confirm the existence of user accounts. This vulnerability is classified under CWE-204 (Information Exposure Through Discrepancy). The CVSS 3.1 base score is 5.3, reflecting a network attack vector with low complexity, no privileges required, and no user interaction needed. Confidentiality impact is low, with no impact on integrity or availability.

The vulnerability allows an unauthenticated remote attacker to confirm valid usernames in the application by observing server response discrepancies in the forgot password feature. This information disclosure can aid in further targeted attacks such as phishing or brute force attempts. There is no direct impact on data integrity or availability.

No official patch or remediation information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider implementing uniform responses for the forgot password functionality to prevent user enumeration.