CVE-2019-19805

CVE-2019-19805 is a timing-based user enumeration vulnerability affecting MFScripts YetiShare versions 3.5.2 through 4.5.3. The _account_forgot_password.ajax.php script exhibits a discernible time difference in its response based on whether a provided email address is associated with an existing account. This allows an unauthenticated attacker to enumerate valid user accounts by guessing email addresses. Rated with a CVSS score of 5.3 (Medium), the vulnerability has a low impact on confidentiality and requires no user interaction or privileges to exploit. There is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.