CVE-2004-1428 ArGoSoft FTP before 1.4.2.1 generates an error message if the user name does not exist instead of prompting for a password, which allows remote attackers to determine valid usernames.
MediumCVSS 5.0
EPSS 2.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
ArGoSoft FTP before 1.4.2.1 generates an error message if the user name does not exist instead of prompting for a password, which allows remote attackers to determine valid usernames.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| argosoft ftp server | < 1.4.2.1 | 1.4.2.1 |
References
- 20041231 ArGoSoft FTP Server reveals valid usernames and allows for brute force attacks mailing-list third-party-advisory
- 13063 broken-link third-party-advisory
- 1012744 broken-link third-party-advisory vdb-entry
- www.argosoft.com broken-link
- www.lovebug.org broken-link url-repurposed
- 11335 broken-link vdb-entry
- 12139 broken-link third-party-advisory vdb-entry
- argosoft-information-disclosure(18721) third-party-advisory vdb-entry