Fixed Account security lock message leaks email

K

Kirby

Well-known member
Licensed customer
Affected version
2.3.13
When a login attempt is made for an account that has a security lock Must reset password phrase your_account_is_currently_security_locked_and_awaiting_password_reset is shown to the visitor:

Code: 
Your account is currently security locked and awaiting a password reset. A request was sent to {email}<br />
<a href="{resendLink}" data-xf-click="overlay">Resend request</a>

This phrase contains the accout {email} which is shown to the visitor.

It is somewhat likely that an account with such a security lock is accessed by an unauthorized entity so such private data shouldn't be shown as that might give an attacker more information than they already have and / or a new attack target.
 
Yeah, it should just say "to the email currently on file" or something, not the actual email (or mask the email as some sites do).
 
Thank you for reporting this issue, it has now been resolved. We are aiming to include any changes that have been made in a future XF release (2.3.14).

Change log:
Mask the account email shown on security lock messages
Click to expand...
There may be a delay before changes are rolled out to the XenForo Community.
 
Back
Top Bottom