PyPI/weblate CVE-2017-5537: medium 5.3, EPSS 2.31%

Weblate user account enumeration via reset password form

Action: Upgrade weblate to 2.10.1 or later.

pip install weblate==2.10.1

Affected

Fixed versions

Sources

• osv: GHSA-j24g-gm76-j829
• https://nvd.nist.gov/vuln/detail/CVE-2017-5537
• https://github.com/WeblateOrg/weblate/issues/1317
• https://github.com/WeblateOrg/weblate/commit/abe0d2a29a1d8e896bfe829c8461bf8b391f1079
• https://github.com/WeblateOrg/weblate
• https://github.com/WeblateOrg/weblate/blob/weblate-2.10.1/docs/changes.rst
• https://github.com/pypa/advisory-database/tree/main/vulns/weblate/PYSEC-2017-42.yaml
• http://www.openwall.com/lists/oss-security/2017/01/18/11
• http://www.openwall.com/lists/oss-security/2017/01/20/1
• http://www.securityfocus.com/bid/95676

CVE-2017-5537 · published 2022-05-17T02:54:32Z · modified 2024-11-19T16:23:11.422157Z · JSON