Description
The password reset feature in Movable Type before 3.2 generates different error messages depending on whether a user exists or not, which allows remote attackers to determine valid usernames.
References
- 14911 vdb-entry
- 20051103 Buggy blogging mailing-list
- 16899 third-party-advisory