CVE-2020-15132: Reset Password / Login vulnerability in Sulu
In Sulu before versions 1.6.35, 2.0.10, and 2.1.1, when the "Forget password" feature on the login screen is used, Sulu asks the user for a username or email address. If the given string is not found, a response with a 400 error code is returned, along with a error message saying that this user name does not exist. This enables attackers to retrieve valid usernames. Also, the response of the "Forgot Password" request returns the email address to which the email was sent, if the operation was successful. This information should not be exposed, as it can be used to gather email addresses. This problem was fixed in versions 1.6.35, 2.0.10 and 2.1.1.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-15132?
CVE-2020-15132 is a vulnerability in Sulu before versions 1.6.35, 2.0.10, and 2.1.1 that allows an attacker to obtain a list of valid usernames or email addresses.
How does CVE-2020-15132 affect Sulu?
CVE-2020-15132 affects Sulu versions 1.6.35, 2.0.10, and 2.1.1, prior to these versions it is not affected.
What is the severity of CVE-2020-15132?
The severity of CVE-2020-15132 is medium with a CVSS score of 5.3.
How can I fix CVE-2020-15132 in Sulu?
To fix CVE-2020-15132 in Sulu, update to versions 1.6.35, 2.0.10, or 2.1.1 or later.
Is there any more information available about CVE-2020-15132?
Yes, you can find more information about CVE-2020-15132 in the Sulu security advisory at the following link: [Sulu Security Advisory](https://github.com/sulu/sulu/security/advisories/GHSA-wfm4-pq59-wg6r)