function user_pass_validate(); disclosure an exist of account and email address on the site.

how to reproduce:
https://drupal.site.com/user/password with captcha enabled. type any email/account you want to check

form errors:
What code is in the image? field is required.
Sorry, admin@sitename.com is not recognized as a user name or an e-mail address.

CommentFileSizeAuthor
#1 Screen Shot 2013-05-19 at 20.20.09.png107.42 KBsoxofaan

Comments

soxofaan’s picture

soxofaan commented
StatusFileSize
new Screen Shot 2013-05-19 at 20.20.09.png107.42 KB

What has this to do with CAPTCHA?

Even without CAPTCHA module enabled, you get "is not recognized as a user name or an e-mail address" error messages

soxofaan’s picture

soxofaan commented
Project: CAPTCHA » Drupal core
Version: 6.x-2.4 » 6.x-dev
Component: Code » user.module
soxofaan’s picture

soxofaan commented
Issue summary: View changes

added more information

jacob.embree’s picture

jacob.embree commented
Issue summary: View changes
Status: Active » Closed (won't fix)

Disclosure of usernames and user ids is not considered a weakness.

avpaderno’s picture

avpaderno
he/him
Primary language Italian
Location Brescia, 🇮🇹 🇪🇺
commented
Issue tags: -security disclosure captcha