Threats tagged 'ghsa-fp2h-r7g9-hq37'

Apache Roller versions 4.0 through 6.1.6 contain a vulnerability that allows any logged-in user to discover other users' email addresses. This occurs because the user search function in the authoring interface matches search input against email addresses as well as usernames, despite only displaying usernames. This flaw enables an attacker to confirm email addresses one character at a time. The issue is resolved in Apache Roller 6.1.7 and later, where the search matches only usernames for non-administrators.