CVE-2019-18986

Name of the Vulnerable Software and Affected Versions Pimcore versions prior to 6.2.2

Description The issue allows attackers to brute-force valid usernames by utilizing the 'forgot password' functionality. This is possible because the functionality returns distinct messages for invalid passwords and non-existing users.

Recommendations For versions prior to 6.2.2, update to version 6.2.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the 'forgot password' functionality to minimize the risk of exploitation.