Information disclosure in Request New Password feature
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.3epss 0.8%
exploitation probability
0.8%top 47% of all CVEs
observed exploitation
nono source reports it
Attacker is able to determine if the provided username exists (and it's valid) using Request New Password feature, based on the response time.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected products
OTRS AG · OTRS