| 제목 | atjiu https://github.com/atjiu/pybbs <=6.0.0 Enumerate registered emails |
|---|
| 설명 | In the latest v6.0.0 version, the endpoint /api/settings/sendEmailCode has a logic issue. The error message indicates that the email has already been registered, and there are no security measures such as rate limiting or CSRF protection. This allows attackers to exploit this error message to brute-force registered users' emails, thereby leaking the email addresses of registered users. |
|---|
| 원천 | ⚠️ https://github.com/atjiu/pybbs/issues/202 |
|---|
| 사용자 | ZAST.AI (UID 87884) |
|---|
| 제출 | 2025. 07. 25. AM 03:33 (1 년도 ago) |
|---|
| 모더레이션 | 2025. 08. 04. PM 03:05 (10 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 318677 [atjiu pybbs 까지 6.0.0 Registered Email SettingsApiController.java sendEmailCode email 정보 공개] |
|---|
| 포인트들 | 19 |
|---|