In SapphireIMS 4097_1, it is possible to guess the registered/active usernames of the software from the errors it gives out for each type…
mitre·CWE-209·Published 2021-08-11
In SapphireIMS 4097_1, it is possible to guess the registered/active usernames of the software from the errors it gives out for each type of user on the Login form. For "Incorrect User" - it gives an error "The application failed to identify the user. Please contact administrator for help." For "Correct User and Incorrect Password" - it gives an error "Authentication failed. Please login again."
In SapphireIMS 4097_1, it is possible to guess the registered/active usernames of the software from the errors it gives out for each type of user on the Login form. For "Incorrect User" - it gives an error "The application failed to identify the user. Please contact administrator for help." For "Correct User and Incorrect Password" - it gives an error "Authentication failed. Please login again."
En SapphireIMS versión 4097_1, es posible adivinar los nombres de usuario registrados/activos del software a partir de los errores que arroja para cada tipo de usuario en el formulario de inicio de sesión. Para "Incorrect User" - da un error "The application failed to identify the user. Please contact administrator for help.". Para "Correct User and Incorrect Password" - da un error "Authentication failed. Please login again."
| Version | Type | Source | Base | Exp | Impact | Vector |
|---|---|---|---|---|---|---|
| 2.0 | Primary | NVD | 5.0 | 10.0 | 2.9 | AV:N/AC:L/Au:N/C:P/I:N/A:N |
| 3.1 | Primary | NVD | 7.5 | 3.9 | 3.6 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |