Описание
An issue was discovered in /goform/login_process in Reprise RLM 14.2. When an attacker attempts to login, the response if a username is valid includes Login Failed, but does not include this string if the username is invalid. This allows an attacker to enumerate valid users.
Ссылки
- ExploitThird Party AdvisoryVDB Entry
- PatchProductVendor Advisory
- Broken Link
- ExploitThird Party AdvisoryVDB Entry
- PatchProductVendor Advisory
- Broken Link
Уязвимые конфигурации
Конфигурация 1Версия от 14.2 (включая) до 15.1 (исключая)
cpe:2.3:a:reprisesoftware:reprise_license_manager:*:*:*:*:*:*:*:*
EPSS
Процентиль: 76%
0.0095
Низкий
5.3 Medium
CVSS3
5 Medium
CVSS2
Дефекты
CWE-209
Связанные уязвимости
CVSS3: 5.3
github
около 4 лет назад
An issue was discovered in /goform/login_process in Reprise RLM 14.2. When an attacker attempts to login, the response if a username is valid includes Login Failed, but does not include this string if the username is invalid. This allows an attacker to enumerate valid users.
EPSS
Процентиль: 76%
0.0095
Низкий
5.3 Medium
CVSS3
5 Medium
CVSS2
Дефекты
CWE-209