|
|
Info |
Last Modified |
| 7 months ago |
|
|
|
|
Description |
WebCalendar contains a flaw that may lead to an unauthorized information disclosure. The issue is triggered when invalid credentials are provided to the application. The application responds with different messages to valid and invalid user name/password combinations, allowing an attacker to enumerate valid user names and resulting in a loss of confidentiality.
|
|
Classification |
Location:
Remote/Network Access Required
Attack Type:
Information Disclosure
Impact:
Loss of Confidentiality
Exploit:
Exploit Available
Disclosure:
OSVDB Verified
OSVDB:
Web Related
|
|
Solution |
Upgrade to upcoming version 1.1, as the vendor has announced that it will fix this vulnerability. An upgrade will required as there are no known workarounds.
|
|
Products |
|
WebCalendar
 |
1.0.1 |
1.0.2 |
1.0.3 |
|
|
|
|
|
|
Credit |
- David Maciejak - david.maciejak
 gmail.com -
|
|
BlogsProvided by Technorati
|
None found at this time
|
|
|
