JhumanJ OpnForm Forgotten Password Information Exposure Vulnerability

A vulnerability allowing information exposure has been identified in JhumanJ OpnForm versions through 1.9.3. This issue affects the Forgotten Password Handler component, specifically the /api/password/email endpoint. The vulnerability arises from the application sending different responses based on certain conditions, which can be observed by an unauthorized user. This discrepancy allows for account enumeration, as two of the response messages indicate the existence of an account. The vulnerability can be exploited remotely and is considered to have high complexity.

Impact

Exploitation of this vulnerability leads to unauthorized information exposure, allowing for account enumeration through the forgotten password functionality.

Reproduction

To reproduce this vulnerability, send a request to the /api/password/email endpoint without authentication. The response will indicate whether the account exists based on the message returned. This behavior can be observed by an unauthorized user, facilitating account enumeration.