CVE-2012-5055

2012-12-0500:00:00

ubuntu.com

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.002 Low

EPSS

Percentile

53.4%

JSON

DaoAuthenticationProvider in VMware SpringSource Spring Security before
2.0.8, 3.0.x before 3.0.8, and 3.1.x before 3.1.3 does not check the
password if the user is not found, which makes the response delay shorter
and might allow remote attackers to enumerate valid usernames via a series
of login requests.