CVE-2009-0348
published 2009-01-29CVE-2009-0348: The login module in Sun Java System Access Manager 6 2005Q1 (aka 6.3), 7 2005Q4 (aka 7.0), and 7.1 responds differently to a failed login attempt depending on…
PriorityP336medium5CVSS 2.0
AVNACLAuNCPINAN
EXPLOIT
EPSS
8.16%
94.2th percentile
The login module in Sun Java System Access Manager 6 2005Q1 (aka 6.3), 7 2005Q4 (aka 7.0), and 7.1 responds differently to a failed login attempt depending on whether the user account exists, which allows remote attackers to enumerate valid usernames.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| sun | java_system_access_manager | — | — |
| sun | java_system_access_manager | — | — |
| sun | java_system_access_manager | — | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No writeups or analysis indexed.
http://secunia.com/advisories/33688http://sunsolve.sun.com/search/document.do?assetkey=1-21-119465-15-1http://sunsolve.sun.com/search/document.do?assetkey=1-66-242026-1http://www.securityfocus.com/bid/33489http://www.vupen.com/english/advisories/2009/0269https://exchange.xforce.ibmcloud.com/vulnerabilities/48283http://secunia.com/advisories/33688http://sunsolve.sun.com/search/document.do?assetkey=1-21-119465-15-1http://sunsolve.sun.com/search/document.do?assetkey=1-66-242026-1http://www.securityfocus.com/bid/33489http://www.vupen.com/english/advisories/2009/0269https://exchange.xforce.ibmcloud.com/vulnerabilities/48283
2009-01-29
Published