User Enumeration Vulnerability in JForum 2.1.8

CVE-2019-7550 · MEDIUM Severity

AV:N/AC:L/AU:N/C:P/I:N/A:N

In JForum 2.1.8, an unauthenticated, remote attacker can enumerate whether a user exists by using the "create user" function. If a register/check/username?username= request corresponds to a username that exists, then an "is already in use" error is produced. NOTE: this product is discontinued.

Learn more about our User Device Pen Test.