CVE-2009-1803
FreePBX 2.4.x-2.5.x and 2.6.x - Username Enumeration via Login Error Messages
Title source: llmDescription
FreePBX 2.5.1, and other 2.4.x, 2.5.x, and pre-release 2.6.x versions, generates different error messages for a failed login attempt depending on whether the user account exists, which allows remote attackers to enumerate valid usernames.
References (4)
Core 4
Core References
Third Party Advisory, VDB Entry vdb-entry
x_refsource_osvdb
http://www.osvdb.org/54263
Various Sources x_refsource_confirm
http://freepbx.org/trac/ticket/3660
Vendor Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/34772
Patch vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/34857
Scores
EPSS
0.0122
EPSS Percentile
65.0%
Details
CWE
CWE-200
Status
published
Products (12)
freepbx/freepbx
2.4
freepbx/freepbx
2.4.0_beta1
freepbx/freepbx
2.4.0_beta2
freepbx/freepbx
2.4.1
freepbx/freepbx
2.5
freepbx/freepbx
2.5.0_beta1
freepbx/freepbx
2.5.0rc2
freepbx/freepbx
2.5.0rc3
freepbx/freepbx
2.5.1
freepbx/freepbx
2.5.2
... and 2 more
Published
May 28, 2009
Tracked Since
Feb 18, 2026