Description
Flyspray 0.9.9.4 generates different error messages depending on whether the username is valid or invalid, which allows remote attackers to enumerate usernames.
References
- 29215 third-party-advisory
- flyspray-username-information-disclosure(40964) vdb-entry
- 20080303 [DSECRG-08-017] Flyspray 0.9.9.4 Multiple Security Vulnerabilities mailing-list