CVE-2013-6043

2014-12-2718:59:03

CWE-200

[email protected]

web.nvd.nist.gov

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

AI Score

6.8

Confidence

Low

EPSS

0.003

Percentile

70.7%

JSON

The login function in Softaculous Webuzo before 2.1.4 provides different error messages for invalid authentication attempts depending on whether the user account exists, which allows remote attackers to enumerate usernames via a series of requests.

Affected configurations

Nvd

Node

softaculouswebuzoRange≤2.1.3

softaculouswebuzoMatch2.1.0

softaculouswebuzoMatch2.1.1

softaculouswebuzoMatch2.1.2

VendorProductVersionCPE
softaculouswebuzo*cpe:2.3:a:softaculous:webuzo:*:*:*:*:*:*:*:*
softaculouswebuzo2.1.0cpe:2.3:a:softaculous:webuzo:2.1.0:*:*:*:*:*:*:*
softaculouswebuzo2.1.1cpe:2.3:a:softaculous:webuzo:2.1.1:*:*:*:*:*:*:*
softaculouswebuzo2.1.2cpe:2.3:a:softaculous:webuzo:2.1.2:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
softaculous	webuzo	*	cpe:2.3:a:softaculous:webuzo::::::::
softaculous	webuzo	2.1.0	cpe:2.3:a:softaculous:webuzo:2.1.0:::::::*
softaculous	webuzo	2.1.1	cpe:2.3:a:softaculous:webuzo:2.1.1:::::::*
softaculous	webuzo	2.1.2	cpe:2.3:a:softaculous:webuzo:2.1.2:::::::*