CyberRota Analysis
AI-GeneratedThe ForgotPasswordView in djangoSIGE versions up to 1.10 contains a user enumeration vulnerability that allows unauthenticated attackers to discern valid accounts by analyzing differing error messages from the password reset endpoint. This could lead to targeted attacks against existing users. Organizations using djangoSIGE should prioritize patching this vulnerability to protect user account integrity and prevent potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
djangoSIGE through 1.10 (commit a6fe7e8) contains a user enumeration vulnerability in ForgotPasswordView within djangosige/apps/login/views.py that allows unauthenticated attackers to identify valid accounts by observing distinct error messages returned by the password reset endpoint. Attackers can submit arbitrary usernames or email addresses to the POST login/esqueceu/ endpoint and distinguish between existing and non-existing accounts based on observable discrepancies in the application's responses.