{"api_version":"1","generated_at":"2026-07-23T15:32:49+00:00","cve":"CVE-2019-19805","urls":{"html":"https://cve.report/CVE-2019-19805","api":"https://cve.report/api/cve/CVE-2019-19805.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2019-19805","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2019-19805"},"summary":{"title":"CVE-2019-19805","description":"_account_forgot_password.ajax.php in MFScripts YetiShare 3.5.2 through 4.5.3 takes a different amount of time to return depending on whether an email address is configured for the account name provided. This can be used by an attacker to enumerate accounts by guessing email addresses.","state":"PUBLIC","assigner":"cve@mitre.org","published_at":"2019-12-30 18:15:00","updated_at":"2023-11-07 03:07:00"},"problem_types":["CWE-203"],"metrics":[],"references":[{"url":"https://medium.com/@jra8908/yetishare-3-5-2-4-5-3-multiple-vulnerabilities-2d01d0cd7459","name":"https://medium.com/@jra8908/yetishare-3-5-2-4-5-3-multiple-vulnerabilities-2d01d0cd7459","refsource":"MISC","tags":["Third Party Advisory"],"title":"YetiShare 3.5.2–4.5.3, Multiple vulnerabilities | by Jinny Ramsmark | Medium","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://medium.com/%40jra8908/yetishare-3-5-2-4-5-3-multiple-vulnerabilities-2d01d0cd7459","name":"https://medium.com/%40jra8908/yetishare-3-5-2-4-5-3-multiple-vulnerabilities-2d01d0cd7459","refsource":"","tags":[],"title":"YetiShare 3.5.2–4.5.3, Multiple vulnerabilities | by Jinny Ramsmark | Medium","mime":"text/html","httpstatus":"410","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-19805","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-19805","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2019","cve_id":"19805","vulnerable":"1","versionEndIncluding":"4.5.3","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mfscripts","cpe5":"yetishare","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2019-19805","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"_account_forgot_password.ajax.php in MFScripts YetiShare 3.5.2 through 4.5.3 takes a different amount of time to return depending on whether an email address is configured for the account name provided. This can be used by an attacker to enumerate accounts by guessing email addresses."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"refsource":"MISC","name":"https://medium.com/@jra8908/yetishare-3-5-2-4-5-3-multiple-vulnerabilities-2d01d0cd7459","url":"https://medium.com/@jra8908/yetishare-3-5-2-4-5-3-multiple-vulnerabilities-2d01d0cd7459"}]}},"nvd":{"publishedDate":"2019-12-30 18:15:00","lastModifiedDate":"2023-11-07 03:07:00","problem_types":["CWE-203"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM"},"exploitabilityScore":3.9,"impactScore":1.4},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":5},"severity":"MEDIUM","exploitabilityScore":10,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:mfscripts:yetishare:*:*:*:*:*:*:*:*","versionStartIncluding":"3.5.2","versionEndIncluding":"4.5.3","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2019","CveId":"19805","Ordinal":"163301","Title":"CVE-2019-19805","CVE":"CVE-2019-19805","Year":"2019"},"notes":[{"CveYear":"2019","CveId":"19805","Ordinal":"1","NoteData":"_account_forgot_password.ajax.php in MFScripts YetiShare 3.5.2 through 4.5.3 takes a different amount of time to return depending on whether an email address is configured for the account name provided. This can be used by an attacker to enumerate accounts by guessing email addresses.","Type":"Description","Title":null},{"CveYear":"2019","CveId":"19805","Ordinal":"2","NoteData":"2019-12-30","Type":"Other","Title":"Published"},{"CveYear":"2019","CveId":"19805","Ordinal":"3","NoteData":"2019-12-30","Type":"Other","Title":"Modified"}]}}}