Lucene search
HistoryAug 18, 2007 - 9:17 p.m.
CVE-2007-4422
cve-2007-4422
symantec
enterprise firewall
vpn
psk
authentication
remote attackers
username enumeration
9.3 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:C/I:C/A:C
6.9 Medium
AI Score
Confidence
Low
0.463 Medium
EPSS
Percentile
97.4%
The login interface in Symantec Enterprise Firewall 6.x, when a VPN with pre-shared key (PSK) authentication is enabled, generates different responses depending on whether or not a username is valid, which allows remote attackers to enumerate valid usernames.
Affected configurations
Node
symantecenterprise_firewallMatch6
| CPE | Name | Operator | Version |
|---|---|---|---|
| symantec:enterprise_firewall | symantec enterprise firewall | eq | 6 |
Related
nvd
nvd
CVE-2007-4422
2007-08-18 21:17:00
prion
prion
Authentication flaw
2007-08-18 21:17:00
cvelist
cvelist
CVE-2007-4422
2007-08-18 21:00:00
9.3 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:C/I:C/A:C
6.9 Medium
AI Score
Confidence
Low
0.463 Medium
EPSS
Percentile
97.4%
Related for CVE-2007-4422