Medium severity · published Mar 15, 2017
CVE-2017-5537
The password reset form in Weblate before 2.10.1 provides different error messages depending on whether the email address is associated with an account, which allows remote…
5.3
CVSS
2.3%
EPSS
No
On KEV
Description
The password reset form in Weblate before 2.10.1 provides different error messages depending on whether the email address is associated with an account, which allows remote attackers to enumerate user accounts via a series of requests.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.3% · higher than 83% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WE
Weblate · Weblate
through 2.10 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-5537
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-5537
Mailing List
http://www.openwall.com/lists/oss-security/2017/01/18/11
Mailing List
http://www.openwall.com/lists/oss-security/2017/01/20/1
Third Party Advisory
http://www.securityfocus.com/bid/95676
Patch
https://github.com/WeblateOrg/weblate/blob/weblate-2.10.1/docs/changes.rst
Patch
https://github.com/WeblateOrg/weblate/commit/abe0d2a29a1d8e896bfe829c8461bf8b391f1079
Issue Tracking
https://github.com/WeblateOrg/weblate/issues/1317
More from Weblate
9.8
CVE-2025-64725
Weblate has improper validation upon invitation acceptance
9.1
CVE-2026-24126
Weblate has an argument injection in management console
9.1
CVE-2025-68398
Weblate has git config file overwrite vulnerability that leads to remote code execution
8.8
CVE-2026-34393
Weblate: Privilege escalation in the user API endpoint
8.8
CVE-2022-23915
The package weblate from 0 and before 4.11.1 are vulnerable to Remote Code Execution (RCE) via argument injection when using git or mercurial repositories