Default credentials

2012-12-0517:55:00

PRIOn knowledge base

www.prio-n.com

7.2 High

AI Score

Confidence

Low

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.002 Low

EPSS

Percentile

50.7%

JSON

DaoAuthenticationProvider in VMware SpringSource Spring Security before 2.0.8, 3.0.x before 3.0.8, and 3.1.x before 3.1.3 does not check the password if the user is not found, which makes the response delay shorter and might allow remote attackers to enumerate valid usernames via a series of login requests.

CPENameOperatorVersion
springsource_spring_securityeq2.0.3
springsource_spring_securityle2.0.6
springsource_spring_securityeq2.0.5
springsource_spring_securityeq2.0.2
springsource_spring_securityeq2.0.0
springsource_spring_securityeq2.0.1
springsource_spring_securityeq2.0.4
springsource_spring_securityeq3.0.0
springsource_spring_securityeq3.0.2
springsource_spring_securityeq3.0.5

Name	Operator	Version
springsource_spring_security	eq	2.0.3
springsource_spring_security	le	2.0.6
springsource_spring_security	eq	2.0.5
springsource_spring_security	eq	2.0.2
springsource_spring_security	eq	2.0.0
springsource_spring_security	eq	2.0.1
springsource_spring_security	eq	2.0.4
springsource_spring_security	eq	3.0.0
springsource_spring_security	eq	3.0.2
springsource_spring_security	eq	3.0.5