CVE-2017-5537

The password reset form in Weblate before 2.10.1 provides different error messages depending on whether the email address is associated with an account, which allows remote attackers to enumerate user accounts via a series of requests.

• CWE-200

• http://www.openwall.com/lists/oss-security/2017/01/18/11Mailing List, Patch
• http://www.openwall.com/lists/oss-security/2017/01/20/1Mailing List, Patch
• http://www.securityfocus.com/bid/95676Third Party Advisory, VDB Entry
• https://github.com/WeblateOrg/weblate/blob/weblate-2.10.1/docs/changes.rstPatch, Release Notes
• https://github.com/WeblateOrg/weblate/commit/abe0d2a29a1d8e896bfe829c8461bf8b391f1079Patch
• https://github.com/WeblateOrg/weblate/issues/1317Issue Tracking, Patch
• http://www.openwall.com/lists/oss-security/2017/01/18/11Mailing List, Patch
• http://www.openwall.com/lists/oss-security/2017/01/20/1Mailing List, Patch
• http://www.securityfocus.com/bid/95676Third Party Advisory, VDB Entry
• https://github.com/WeblateOrg/weblate/blob/weblate-2.10.1/docs/changes.rstPatch, Release Notes
• https://github.com/WeblateOrg/weblate/commit/abe0d2a29a1d8e896bfe829c8461bf8b391f1079Patch
• https://github.com/WeblateOrg/weblate/issues/1317Issue Tracking, Patch

Published

Mar 15, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-5531Deployments of TIBCO Managed File Transfer Command Center ve…8
• CVE-2017-5532A vulnerability in the report renderer component of TIBCO Ja…5.4
• CVE-2017-5533A vulnerability in the server content cache of TIBCO JasperR…9.3
• CVE-2017-5534The tibbr user profiles components of tibbr Community, and t…8.8
• CVE-2017-5535The GridServer Broker, GridServer Driver, and GridServer Eng…6.8
• CVE-2017-5536The GridServer Broker, and GridServer Director components of…6.3
• CVE-2017-5538The kbase_dispatch function in arm/t7xx/r5p0/mali_kbase_core…
• CVE-2017-5539The patch for directory traversal (CVE-2017-5480) in b2evolu…
• CVE-2017-5541Directory traversal vulnerability in template/usererror.miss…
• CVE-2017-5542Cross-site scripting (XSS) vulnerability in template/usererr…
• CVE-2017-5543includes/classes/ia.core.users.php in Subrion CMS 4.0.5 allo…
• CVE-2017-5544An issue was discovered on FiberHome Fengine S5800 switches …5.9