VYPR
Get started
← All advisories
Medium severity5.3NVD Advisory· Published Mar 15, 2017· Updated May 13, 2026

CVE-2017-5537

CVE-2017-5537

Description

The password reset form in Weblate before 2.10.1 provides different error messages depending on whether the email address is associated with an account, which allows remote attackers to enumerate user accounts via a series of requests.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
weblatePyPI
< 2.10.12.10.1

Affected products

1

Patches

1
abe0d2a29a1d

Do not show validation error on password reset

https://github.com/WeblateOrg/weblateMichal ČihařJan 17, 2017via ghsa
commit
2 files changed · +19 −0
  • weblate/accounts/tests/test_registration.py+17 −0 modified
    @@ -210,6 +210,23 @@ def test_reset(self):
 
         self.assert_registration('[Weblate] Password reset on Weblate')
 
+    def test_reset_nonexisting(self):
+        '''
+        Test for password reset.
+        '''
+        response = self.client.get(
+            reverse('password_reset'),
+        )
+        self.assertContains(response, 'Reset my password')
+        response = self.client.post(
+            reverse('password_reset'),
+            {
+                'email': 'test@example.com'
+            }
+        )
+        self.assertRedirects(response, reverse('email-sent'))
+        self.assertEqual(len(mail.outbox), 0)
+
     def test_reset_twice(self):
         '''
         Test for password reset.
  • weblate/accounts/views.py+2 −0 modified
    @@ -572,6 +572,8 @@ def reset_password(request):
 
             request.session['password_reset'] = True
             return complete(request, 'email')
+        else:
+            return redirect('email-sent')
     else:
         form = ResetForm()

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

9

News mentions

0

No linked articles in our index yet.