Threats tagged 'ghsa-chjw-mx5g-h9jm'

Apache Roller versions 4.0 through 6.1.6 contain a vulnerability that allows unauthenticated visitors to retrieve email addresses of commenters. This occurs because the search index stores commenter email addresses and the public weblog search accepts queries on this field, including wildcard queries that can confirm email addresses character by character. The issue is addressed in Apache Roller 6.1.7 and later versions by rebuilding the search index.