CVE-2021-39189: medium-severity vulnerability in pimcore
Observable Response Discrepancy in Lost Password Service
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
Pimcore's password reset feature reveals whether a username exists in the system through observable differences in the response, allowing attackers to discover valid user accounts.
An attacker can enumerate valid usernames by submitting password reset requests and observing response discrepancies (CWE-204), which leak information about account existence without authentication. This requires only network access to the forgot password endpoint and impacts confidentiality of user account information.
In the same product, most dangerous first.