CVE-2024-47057: User name enumeration possible due to response time difference on password reset form

Vulnerability summary

CVE-2024-47057 is a medium (CVSS 5.3) Observable Discrepancy vulnerability in mautic. EPSS estimates a 0.31% chance of exploitation in the next 30 days, higher than 23% of scored vulnerabilities.

Timeline

1. 28-05-2025
   PublishedVulnerability first disclosed.
2. 29-05-2025
   Last modifiedVulnerability information updated.

Description

SummaryThis advisory addresses a security vulnerability in Mautic related to the "Forget your password" functionality. This vulnerability could be exploited by unauthenticated users to enumerate valid usernames. User Enumeration via Timing Attack: A user enumeration vulnerability exists in the "Forget your password" functionality. Differences in response times for existing and non-existing users, combined with a lack of request limiting, allow an attacker to determine the existence of usernames through a timing-based attack. MitigationPlease update to a version that addresses this timing vulnerability, where password reset responses are normalized to respond at the same time regardless of user existence.

• CWE-203Observable DiscrepancyThe product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor.