CyberCertPrepWeb App FundamentalsCommon Web Vulnerabilities (OWASP Intro)EASYFree question
An application uses a 'forgot username' feature that reveals whether an email is registered: 'If this email is registered, you'll receive a username.' What OWASP vulnerability is this?
- A.User enumeration - the application confirms whether an email address is registered, helping attackers identify valid accounts for targeted attacks
- B.CSRF via the forgot-username endpoint
- C.Broken access control on the username endpoint
- D.SQL injection via the email parameter
Why A is correct
User enumeration allows attackers to identify valid account identifiers before attacking them. Even subtle differences (response time, HTTP status code, message wording) can confirm account existence. Best practice is to use identical responses for registered and unregistered accounts: 'If this email is associated with an account, you will receive a message.'
Know someone studying for Web App Fundamentals? Send them this one.