CVE-2020-9389

2021-02-0319:03:47

mitre

www.cve.org

cve-2020-9389

squaredup

username enumeration

AI Score

4.2

Confidence

High

EPSS

0.001

Percentile

34.3%

JSON

A username enumeration issue was discovered in SquaredUp before version 4.6.0. The login functionality was implemented in a way that would enable a malicious user to guess valid username due to a different response time from invalid usernames.

References

support.squaredup.com/hc/en-us/articles/360017255858

support.squaredup.com/hc/en-us/articles/360019427238-CVE-2020-9389-Username-enumeration-possible-via-a-timing-attack