CyberCertPrepWeb App FundamentalsCommon Web Vulnerabilities (OWASP Intro)EASYFree question
A web application has a 'forgot password' form that shows different messages for existing vs. non-existing email addresses. How does this create a security issue?
- A.Username/email enumeration: an attacker can determine which email addresses have accounts by observing different server responses, enabling targeted phishing and credential stuffing against known accounts
- B.It creates a CSRF vulnerability on the password reset form
- C.The different messages cause caching issues that leak session data
- D.This is only a usability issue with no security implications
Why A is correct
User enumeration (A07 adjacent) allows attackers to build a list of valid accounts. With a list of valid email addresses, attackers can: conduct targeted phishing, try credential stuffing with higher success rates, or harass specific users. The fix: return the same response ('If an account exists, a reset email was sent') regardless of whether the email is registered, making enumeration impossible.
Know someone studying for Web App Fundamentals? Send them this one.