User Enumeration in iRecruitment

The “Forgot Password” functionality in IRecruitment module provides unique responses when a valid/invalid email is submitted to the application. The application provides responses which indicate if the supplied email address is valid. This may allow a malicious user to enumerate valid accounts. These accounts can be used to launch a password guessing attack.

Recommendation is that the failure responses should be generic and not specify that email or username was invalid and not registered in the application. Application should always display an "email sent" message, but only send an email to registered users or send different content depending on whether the user is registered or not.