VULNERABILITY INTELLIGENCE

CVE-2023-53943

CVSS score5.3 MEDIUM

EPSS probability0.35%

CISA KEVNot currently listed

Published2025-12-18

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Description

GLPI 9.5.7 contains a username enumeration vulnerability in the lost password recovery mechanism that allows attackers to validate email addresses. Attackers can systematically test email addresses by submitting requests to the password reset endpoint and analyzing response differences to identify valid user accounts.

Weakness classification

disclosure@vulncheck.com: CWE-203

Primary references

disclosure@vulncheck.com — Product
disclosure@vulncheck.com — Exploit, Third Party Advisory
disclosure@vulncheck.com — Third Party Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0 — Exploit, Third Party Advisory