Read the docs
TI-2020-11905 Aliases CVE-2020-15132GHSA-wfm4-pq59-wg6r

Reset Password / Login vulnerability in Sulu

Priority LOW 26CWE-209Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-209.

Summary

In Sulu before versions 1.6.35, 2.0.10, and 2.1.1, when the "Forget password" feature on the login screen is used, Sulu asks the user for a username or email address. If the given string is not found, a response with a `400` error code is returned, along with a error message saying that this user name does not exist. This enables attackers to retrieve valid usernames. Also, the response of the "Forgot Password" request returns the email address to which the email was sent, if the operation was successful. This information should not be exposed, as it can be used to gather email addresses. This problem was fixed in versions 1.6.35, 2.0.10 and 2.1.1.

Why it matters now

EPSS 0.01112 66th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed sulu (sulu): 1.6.35, 2.0.10sulu/sulu (Packagist): 1.6.34, 2.0.10, 2.1.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
sulusulubefore 1.6.35; 2.0.0 to before 2.0.10; = 2.1.01.6.35, 2.0.10Patch availableCNA
—sulu/sulu (Packagist)before 1.6.341.6.34Patch availableGHSA-wfm4-pq59-wg6r
—sulu/sulu (Packagist)2.0.0 to before 2.0.102.0.10Patch availableGHSA-wfm4-pq59-wg6r
—sulu/sulu (Packagist)2.1.0 to before 2.1.12.1.1Patch availableGHSA-wfm4-pq59-wg6r
  • sulu Vendorsulu Affected before 1.6.35; 2.0.0 to before 2.0.10; = 2.1.0 Fixed in 1.6.35, 2.0.10 Patch available CNA
  • sulu/sulu (Packagist) Vendor— Affected before 1.6.34 Fixed in 1.6.34 Patch available GHSA-wfm4-pq59-wg6r
  • sulu/sulu (Packagist) Vendor— Affected 2.0.0 to before 2.0.10 Fixed in 2.0.10 Patch available GHSA-wfm4-pq59-wg6r
  • sulu/sulu (Packagist) Vendor— Affected 2.1.0 to before 2.1.1 Fixed in 2.1.1 Patch available GHSA-wfm4-pq59-wg6r

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:sulu:sulu:*:*:*:*:*:*:*:*before 1.6.35; 2.0.0 to before 2.0.10; 2.1.0 to before 2.1.1Vulnerablesulu
  • cpe:2.3:a:sulu:sulu:*:*:*:*:*:*:*:* Versions before 1.6.35; 2.0.0 to before 2.0.10; 2.1.0 to before 2.1.1 Vulnerable ·sulu

Remediation

  • Fix · CNA sulu (sulu) Fixed in 1.6.35, 2.0.10
  • Fix · GHSA-wfm4-pq59-wg6r sulu/sulu (Packagist) Fixed in 1.6.34 Advisory →
  • Fix · GHSA-wfm4-pq59-wg6r sulu/sulu (Packagist) Fixed in 2.0.10 Advisory →
  • Fix · GHSA-wfm4-pq59-wg6r sulu/sulu (Packagist) Fixed in 2.1.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-15132
  2. 2026-10-03 Alias added: GHSA-wfm4-pq59-wg6r

References

Exploit 1

Advisory 1

Other 1

  • TI-2021-19642 PHP file inclusion in the Sulu admin panel CVSS 3.1HIGH 8.8
  • TI-2024-18520 Sulu grants access to pages regardless of role permissions CVSS 3.1HIGH 8.1
  • TI-2021-12405 XSS Injection in Media Collection Title was possible CVSS 3.1HIGH 8.4
  • TI-2021-19641 Privilege escalation in the Sulu Admin panel CVSS 3.1HIGH 7.2
  • TI-2021-18008 Improper Neutralization HTML tags in sulu/sulu CVSS 3.1MEDIUM 6.2
  • TI-2024-31897 Reflected XSS Vulnerability in Sulu Media Bundle CVSS 3.1MEDIUM 6.1
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences