CVE-2009-0348 The login module in Sun Java System Access Manager 6 2005Q1 (aka 6.3), 7 2005Q4 (aka 7.0), and 7.1 responds differently to a failed login attempt depending on whether the user account exists, which al...
MediumCVSS 5.0
EPSS 8.2%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
The login module in Sun Java System Access Manager 6 2005Q1 (aka 6.3), 7 2005Q4 (aka 7.0), and 7.1 responds differently to a failed login attempt depending on whether the user account exists, which allows remote attackers to enumerate valid usernames.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| sun java system access manager | = 6.3_2005q1 | No fix listed |
| sun java system access manager | = 7.1 | No fix listed |
| sun java system access manager | = 7_2005q4 | No fix listed |
References
- 33688 third-party-advisory vendor-advisory
- sunsolve.sun.com patch
- 242026 patch vendor-advisory
- 33489 vdb-entry
- ADV-2009-0269 vdb-entry
- sun-jsam-username-info-disclosure(48283) vdb-entry