CyberCertPrepWeb App FundamentalsCommon Web Vulnerabilities (OWASP Intro)EASYFree question
A web application has a 'forgot password' form that shows different messages for existing vs. non-existing email addresses. How does this create a security issue?
- A.This is only a usability issue with no security implications; race conditions in web apps are a memory-safety issue confined to C backends, as garbage-collected languages serialize requests; broken access control is detected reliably by automated scanners because authorization rules are declared in HTTP headers
- B.The different messages cause caching issues that leak session data
- C.It creates a CSRF vulnerability on the password reset form
- D.Username/email enumeration: an attacker can determine which email addresses have accounts by observing different server responses, enabling targeted phishing and credential stuffing against known accounts
Why D is correct
User enumeration (A07 adjacent) allows attackers to build a list of valid accounts. With a list of valid email addresses, attackers can: conduct targeted phishing, try credential stuffing with higher success rates, or harass specific users. The fix: return the same response ('If an account exists, a reset email was sent') regardless of whether the email is registered, making enumeration impossible.
Know someone studying for Web App Fundamentals? Send them this one.