| Package | Affected versions | Patched versions |
|---|---|---|
| yetishare | ≥ 3.5.2, ≤ 4.5.4 |
The user-introduction email in MFScripts YetiShare v3.5.2 through v4.5.4 may leak the (system-picked) password if this email is sent in cleartext. In other words, the user is not allowed to choose their own initial password.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free