User Enumeration Vulnerability in Mautic Password Reset Functionality

CVE-2024-47057

What is CVE-2024-47057?

This security vulnerability in Mautic's 'Forget your password' function allows unauthenticated users to exploit timing discrepancies, leading to the enumeration of valid usernames. The lack of request limiting and varying response times for existing and non-existing users enables attackers to determine which usernames are valid through observation of response latency. To mitigate this risk, it is crucial to update to a patched version that normalizes response times for all password reset requests.

References