Lucene search
HistoryAug 18, 2007 - 9:17 p.m.
CVE-2007-4422
cve-2007-4422
symantec
enterprise firewall
vpn
psk
authentication
remote attackers
username enumeration
6.9 Medium
AI Score
Confidence
Low
9.3 High
CVSS2
Access Vector
Access Complexity
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:C/I:C/A:C
0.192 Low
EPSS
Percentile
96.3%
The login interface in Symantec Enterprise Firewall 6.x, when a VPN with pre-shared key (PSK) authentication is enabled, generates different responses depending on whether or not a username is valid, which allows remote attackers to enumerate valid usernames.
Affected configurations
Node
symantecenterprise_firewallMatch6
| CPE | Name | Operator | Version |
|---|---|---|---|
| symantec:enterprise_firewall | symantec enterprise firewall | eq | 6 |
Related
prion
prion
Authentication flaw
2007-08-18 21:17:00
cvelist
cvelist
CVE-2007-4422
2007-08-18 21:00:00
nvd
nvd
CVE-2007-4422
2007-08-18 21:17:00
6.9 Medium
AI Score
Confidence
Low
9.3 High
CVSS2
Access Vector
Access Complexity
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:C/I:C/A:C
0.192 Low
EPSS
Percentile
96.3%
Related for CVE-2007-4422