PT-2002-1283 · Hosting Controller · Hosting Controller

Publicado 2002-05-03 · Atualizado 2016-10-18 · CVE-2002-0212

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Hosting Controller versions 1.1 through 1.4.1

Description The issue allows remote attackers to determine the existence of valid usernames by analyzing different error messages returned during the login process for valid or invalid users, making it easier to conduct a brute force attack.

Recommendations For Hosting Controller versions 1.1 through 1.4.1, consider modifying the login functionality to return generic error messages for both valid and invalid usernames to prevent attackers from identifying existing usernames.

Correção

Identificadores relacionados

CVE-2002-0212

Produtos afetados

Hosting Controller

Referências · 5

• http://securityfocus.com/bid/3971 · Nota
• http://iss.net/security_center/static/8006.php · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2002-0212 · Nota de Segurança
• http://hostingcontroller.com/English/patches/ForAll/index.html · Nota
• http://marc.info/?l=bugtraq&m=101224151705897&w=2 · Nota