CVE-2020-15392

Name of the Vulnerable Software and Affected Versions Venki Supravizio BPM version 10.1.2

Description A user enumeration flaw was found in the password recovery process. This issue allows an attacker to determine if a username is valid or not by analyzing the difference in error messages, enabling a brute-force attack with valid usernames.

Recommendations For Venki Supravizio BPM version 10.1.2, consider modifying the password recovery process to return generic error messages, avoiding the disclosure of valid usernames. As a temporary workaround, restrict access to the password recovery feature to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.