CVE-2004-0294

CVE-2004-0294 describes an information disclosure vulnerability in YaBB 1 SP 1.3.1, where differing error messages for valid versus invalid usernames facilitate user enumeration. This allows remote attackers to identify existing user accounts, simplifying subsequent brute-force password guessing attacks. The vulnerability has a CVSS score of 5.0, indicating a medium severity with network access, low complexity, and potential for partial confidentiality impact. While there is no evidence of active exploitation or public exploit code, the vulnerability has garnered significant community discussion, with 10 mentions across various platforms.