CVE-2024-54002 Dependency-Track allows enumeration of managed users via /api/v1/user/login endpoint

Dependency-Track is a Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Performing a login request against the /api/v1/user/login endpoint with a username that exist in the system takes significantly longer than performing the same...

CVE-2024-54002 Dependency-Track allows enumeration of managed users via /api/v1/user/login endpoint

Dependency-Track is a Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Performing a login request against the /api/v1/user/login endpoint with a username that exist in the system takes significantly longer than performing the same...

CVE-2024-54002

Dependency-Track suffers a timing-based user enumeration flaw in /api/v1/user/login for usernames known to the system (LDAP/OpenID Connect users are unaffected). This CVE identifies that a longer response time reveals valid usernames, with the issue fixed in Dependency-Track 4.12.2. Affected prod...

PT-2024-36009 · Unknown · Dependency-Track

Name of the Vulnerable Software and Affected Versions: Dependency-Track versions prior to 4.12.2 Description: The issue allows actors to enumerate valid names of managed users by leveraging the observable difference in request duration when performing a login request against the...

Dependency-Track 安全漏洞

Dependency-Track is Dependency-Track's open source set of intelligent supply chain component analysis platforms for identifying third-party component risks. A security vulnerability exists in Dependency-Track versions prior to 4.12.2 that stems from a significantly longer response time when...

CVE-2024-38374 vulnerabilities

Vulnerabilities for packages: hadoop-fips, dependency-track...

CVE-2024-38374 vulnerabilities

Vulnerabilities for packages: dependency-track...

GHSA-683X-4444-JXH8 vulnerabilities

Vulnerabilities for packages: dependency-track...

GHSA-683X-4444-JXH8 vulnerabilities

Vulnerabilities for packages: hadoop-fips, dependency-track...

GHSA-24RP-Q3W6-VC56 vulnerabilities

Vulnerabilities for packages: trino, mariadb, dependency-track, keycloak...

GHSA-24RP-Q3W6-VC56 vulnerabilities

Vulnerabilities for packages: trino, keycloak, mariadb, dependency-track...

GHSA-XFG6-62PX-CXC2 vulnerabilities

Vulnerabilities for packages: keycloak-fips, dependency-track, mariadb, keycloak, trino...

GHSA-XFG6-62PX-CXC2 vulnerabilities

Vulnerabilities for packages: trino, keycloak, dependency-track, mariadb...

CVE-2024-1597 vulnerabilities

Vulnerabilities for packages: trino, keycloak, mariadb, dependency-track...

CVE-2024-1597 vulnerabilities

Vulnerabilities for packages: trino, mariadb, dependency-track, keycloak...

GHSA-4265-CCF5-PHJ5 vulnerabilities

Vulnerabilities for packages: druid, trino, tez, wavefront-proxy, spdx-tools-java, gradle, celeborn, dependency-track, opensearch...

GHSA-4265-CCF5-PHJ5 vulnerabilities

Vulnerabilities for packages: wavefront-proxy, kayenta, gradle, opensearch, hadoop-fips, spdx-tools-java, celeborn, dependency-track, tez, trino, druid, kayenta-fips, hadoop-client-modules...

GHSA-4G9R-VXHX-9PGX vulnerabilities

Vulnerabilities for packages: druid, trino, tez, wavefront-proxy, spdx-tools-java, gradle, celeborn, dependency-track, opensearch...

CVE-2024-26308 vulnerabilities

Vulnerabilities for packages: druid, trino, tez, wavefront-proxy, spdx-tools-java, gradle, celeborn, dependency-track, opensearch...

CVE-2024-26308 vulnerabilities

Vulnerabilities for packages: wavefront-proxy, kayenta, gradle, opensearch, hadoop-fips, spdx-tools-java, celeborn, dependency-track, tez, trino, druid, kayenta-fips, hadoop-client-modules...