Tuleap User Enumeration Vulnerability via Password Reset Form

A user enumeration vulnerability has been identified in the Tuleap Open Source Suite, specifically in the Community Edition prior to version 16.9.99.1750843170 and the Enterprise Edition versions prior to 16.8-4 and 16.9-2. The issue arises in the forgot password form, which inadvertently allows for user enumeration by returning different error messages based on the existence of the user account.

Impact

Exploitation of this vulnerability allows for user enumeration, where an attacker can determine which usernames are registered on the platform.

Remediation

Users can upgrade to Tuleap Community Edition version 16.9.99.1750843170 or Tuleap Enterprise Edition versions 16.8-4 and 16.9-2 to address this vulnerability.