medium5.3
CVE-2022-32741
Attacker is able to determine if the provided username exists (and it's valid) using Request New Password feature, based on the response time.
Impact
Attacker is able to determine if the provided username exists (and it's valid) using Request New Password feature, based on the response time.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Otrs | Otrs | from 7.0.0 before 7.0.35 from 8.0.0 before 8.0.23 |