Threats tagged 'ghsa-6v33-jwgx-fxf7'

blueprintUE Self-Hosted Edition versions before 4.3.3 have an account enumeration vulnerability in the ForgotPasswordMiddleware.php component. This flaw allows unauthenticated attackers to determine whether an email address is registered by observing differences in password reset redirect behavior. The vulnerability is exacerbated by the lack of rate limiting on failed lookup attempts, enabling unlimited enumeration.