33688Third-party advisory
http://secunia.com/advisories/33688 CVE-2009-0348
Sun Java System Access Manager 7.1 - 'Username' Enumeration
Record summary
CVE-2009-0348 has a selected CVSS score of 5.0; EIP currently links 1 catalogued exploit.
Description
The login module in Sun Java System Access Manager 6 2005Q1 (aka 6.3), 7 2005Q4 (aka 7.0), and 7.1 responds differently to a failed login attempt depending on whether the user account exists, which allows remote attackers to enumerate valid usernames.
Description source: CVE List
Exploitation context
Available material
- Catalogued exploits
- 1
Proofs of concept
1Catalogued exploits
ExploitDBSun Java System Access Manager 7.1 - 'Username' EnumerationExploitDB exploitby Marco MellaNot analyzed1 file
References
7sunsolve.sun.comConfirmation
http://sunsolve.sun.com/search/document.do?assetkey=1-21-119465-15-1 242026Vendor advisory
http://sunsolve.sun.com/search/document.do?assetkey=1-66-242026-1 33489vdb entry
http://www.securityfocus.com/bid/33489 ADV-2009-0269vdb entry
http://www.vupen.com/english/advisories/2009/0269 sun-jsam-username-info-disclosure(48283)vdb entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/48283 nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2009-0348