CVE-2013-6043 - The login function in Softaculous Webuzo before 2.1.4 provides different error messages for invalid authentication attempts depending on whether the user account exists, which allows remote attackers to enumerate usernames via a series of requests

Back Back to CVE browser

MEDIUM

The login function in Softaculous Webuzo before 2.1.4 provides different error messages for invalid authentication attempts depending on whether the user account exists, which allows remote attackers to enumerate usernames via a series of requests

Published Dec 27, 2014

5.0

MEDIUM

CVSS 2.0

EPSS 2.89%

Description

The login function in Softaculous Webuzo before 2.1.4 provides different error messages for invalid authentication attempts depending on whether the user account exists, which allows remote attackers to enumerate usernames via a series of requests.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-200

Exposure of Sensitive Information

References (2)

http://www.softaculous.com/board/index.php?tid=4526&title=Webuzo_2.1.4_Launched
x_refsource_CONFIRM
https://web.archive.org/web/20140126212101/http://www.baesystemsdetica.com.au/Research/Advisories/Webuzo-Multiple-Vulnerabilities-%28DS-2013-007%29
x_refsource_MISC

Link	Providers	Tags
http://www.softaculous.com/board/index.php?tid=4526&title=Webuzo_2.1.4_Launched		x_refsource_CONFIRM
https://web.archive.org/web/20140126212101/http://www.baesystemsdetica.com.au/Research/Advisories/Webuzo-Multiple-Vulnerabilities-%28DS-2013-007%29		x_refsource_MISC