In Knowage through 6.1.1, an unauthenticated user can enumerated valid usernames via the ChangePwdServlet page.

Published Sep 5, 2019 · Updated Aug 5, 2024 · Assigned by mitre