CVE-2009-0348 Information disclosure in n/a

What is CVE-2009-0348?

CVE-2009-0348 is a medium-severity vulnerability in n/a, published on 29 Jan 2009. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The login module in Sun Java System Access Manager 6 2005Q1 (aka 6.3), 7 2005Q4 (aka 7.0), and 7.1 responds differently to a failed login attempt depending on whether the user account exists, which allows remote attackers to enumerate valid usernames.

Weakness: CWE-200

Which versions are affected by CVE-2009-0348?

It affects 1 product.

Products include Sun Java System Access Manager.

How do I fix CVE-2009-0348?

No fix has been published for CVE-2009-0348 yet. Limit exposure of the affected software until one is available.

Is CVE-2009-0348 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2009-0348 exists.

Public exploit code: 1 Exploit-DB entry.

Other vulnerabilities in n/a

• CVE-2008-2705 Auth bypass in n/a Critical 9.3
• CVE-2009-0169 Privilege escalation in n/a Critical 9.0
• CVE-2008-2945 Code injection in n/a High 7.5
• CVE-2007-5152 Auth bypass in n/a High 7.5
• CVE-2006-0531 Privilege escalation in n/a High 7.2

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-q6r6-8rm7-3r93.