CVE-2012-5055: Infoleak
DaoAuthenticationProvider in VMware SpringSource Spring Security before 2.0.8, 3.0.x before 3.0.8, and 3.1.x before 3.1.3 does not check the password if the user is not found, which makes the response delay shorter and might allow remote attackers to enumerate valid usernames via a series of login requests.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-5055?
CVE-2012-5055 is considered a vulnerability that could allow information disclosure through username enumeration.
How do I fix CVE-2012-5055?
To fix CVE-2012-5055, upgrade VMware SpringSource Spring Security to version 2.0.8, 3.0.8, or 3.1.3 and later.
What versions of Spring Security are affected by CVE-2012-5055?
CVE-2012-5055 affects versions of VMware SpringSource Spring Security before 2.0.8, 3.0.x before 3.0.8, and 3.1.x before 3.1.3.
What are the potential consequences of CVE-2012-5055?
The potential consequences of CVE-2012-5055 include an increased risk of unauthorized access due to username enumeration.
Is there a workaround for CVE-2012-5055?
There are no official workarounds for CVE-2012-5055; the recommended action is to update to a patched version.