CVE-2009-1076

CWE-200 — Information Exposure3 documents3 sources
Severity
5.0MEDIUM
EPSS
0.7%
top 28.29%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
SUN Java System Identity Manager
Timeline
PublishedMar 25
Latest updateMay 2

Description

Sun Java System Identity Manager (IdM) 7.0 through 8.0 responds differently to failed use of the end-user question-based login feature depending on whether the user account exists, which allows remote attackers to enumerate valid usernames.

CVSS vector

AV:N/AC:L/C:P/I:N/A:NExploitability: 10.0 | Impact: 2.9

Affected Packages1 packages

Patches

Patch: sunsolve.sun.com ↗Patch: sunsolve.sun.com ↗Patch: www.securityfocus.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-7p9r-6v39-jx2q: Sun Java System Identity Manager (IdM) 7↗2022-05-02
▶
CVEList
CVE-2009-1076: Sun Java System Identity Manager (IdM) 7↗2009-03-25
▶