CVE-2009-0348: Infoleak
The login module in Sun Java System Access Manager 6 2005Q1 (aka 6.3), 7 2005Q4 (aka 7.0), and 7.1 responds differently to a failed login attempt depending on whether the user account exists, which allows remote attackers to enumerate valid usernames.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2009-0348?
CVE-2009-0348 has a medium severity rating due to the potential for user enumeration.
How do I fix CVE-2009-0348?
To mitigate CVE-2009-0348, implement more uniform responses for failed login attempts regardless of whether the user account exists.
Which versions are affected by CVE-2009-0348?
CVE-2009-0348 affects Sun Java System Access Manager versions 6.3 2005Q1, 7 2005Q4, and 7.1.
What is the impact of CVE-2009-0348?
The impact of CVE-2009-0348 is the ability for attackers to enumerate valid usernames, increasing the risk of unauthorized access.
Is there a workaround for CVE-2009-0348?
A possible workaround for CVE-2009-0348 is to implement account lockout policies after a certain number of failed login attempts.