GHSA-3533-rvpc-6x56

ghsaUSosv

Exposure of Sensitive Information to an Unauthorized Actor in Spring Security

view advisory published 2022-05-17Licence: CC-BY-4.0

DaoAuthenticationProvider in VMware SpringSource Spring Security before 2.0.8, 3.0.x before 3.0.8, and 3.1.x before 3.1.3 does not check the password if the user is not found, which makes the response delay shorter and might allow remote attackers to enumerate valid usernames via a series of login requests.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2012-5055US	medium5.0	1.95% (80th)	—	2012-12-05
DaoAuthenticationProvider in VMware SpringSource Spring Security before 2.0.8, 3.0.x before 3.0.8, and 3.1.x before 3.1.3 does not check the password if the user is not found, whic…

references

External citations — patches, advisories, analysis.

http://support.springsource.com/security/CVE-2012-5055WEB
https://nvd.nist.gov/vuln/detail/CVE-2012-5055ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan