OSVDB ID: 25280 Title: WebCalendar Login Error Message User Account Enumeration |
Info |
|
|
Dates |
||||
|
|
Description |
WebCalendar contains a flaw that may lead to an unauthorized information disclosure. The issue is triggered when invalid credentials are provided to the application. The application responds with different messages to valid and invalid user name/password combinations, allowing an attacker to enumerate valid user names and resulting in a loss of confidentiality. |
Classification |
Location:
Remote / Network Access
Attack Type: Information Disclosure Impact: Loss of Confidentiality Exploit: Exploit Public Disclosure: OSVDB Verified OSVDB: Web Related |
Solution |
Upgrade to upcoming version 1.1, as the vendor has announced that it will fix this vulnerability. An upgrade will required as there are no known workarounds. |
Products |
|
References |
|
Credit |
|
gmail.com -