CVE-2021-39189

Pimcore is an open source data & experience management platform. In versions prior to 10.1.3, it is possible to enumerate usernames via the forgot password functionality. This issue is fixed in version 10.1.3. As a workaround, one may apply the available patch manually.

Pimcore is an open source data & experience management platform. In versions prior to 10.1.3, it is possible to enumerate usernames via the forgot password functionality. This issue is fixed in version 10.1.3. As a workaround, one may apply the available patch manually.

### Impact It is possible to enumerate usernames via the forgot password functionality ### Patches Update to version `10.1.3` or apply this patch manually: https://github.com/pimcore/pimcore/pull/10223.patch ### Workarounds Apply https://github.com/pimcore/pimcore/pull/10223.patch manually.

### Impact It is possible to enumerate usernames via the forgot password functionality ### Patches Update to version `10.1.3` or apply this patch manually: https://github.com/pimcore/pimcore/pull/10223.patch ### Workarounds Apply https://github.com/pimcore/pimcore/pull/10223.patch manually.

Pimcore es una plataforma de administración de datos y experiencias de código abierto. En versiones anteriores a 10.1.3, es posible enumerar los nombres de usuario por medio de la funcionalidad forgot password. Este problema es corregido en versión 10.1.3. Como solución, puede ser aplicado el parche disponible manualmente