-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| weblate | pip | < 2.10.1 | 2.10.1 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from the password reset form leaking account existence through error messages. The commit diff shows the critical fix occurred in weblate/accounts/views.py where the else-clause was modified to redirect to 'email-sent' regardless of validation outcome. This directly addresses CWE-209 (sensitive info in errors) by eliminating differential error messages. The reset_password() function is explicitly responsible for handling password reset logic, making it the clear source of the vulnerability before patching.