DokuWiki Username Enumeration Vulnerability in Password Reset Functionality

A username enumeration vulnerability has been identified in DokuWiki version 2018-04-22b. This issue arises within the password reset feature, allowing attackers to determine valid user accounts. By submitting various usernames to the password reset endpoint and analyzing the server's error response, attackers can distinguish between existing and non-existing accounts.

Impact

Exploitation of this vulnerability allows for username enumeration, enabling attackers to identify valid user accounts.

Reproduction

To reproduce this vulnerability, access the password reset endpoint and submit usernames. For non-valid users, the response will indicate that the user cannot be found. For valid users, the response will mention an error with SMTP communication, indicating a password reset email could not be sent.