PT-2004-2603 · Ca · Ca Unicenter Management Portal

Thomas Adams · Publicado 2004-09-21 · Atualizado 2017-07-11 · CVE-2004-1697

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions CA Unicenter Management Portal versions 2.0 through 3.1

Description The issue concerns the "Forgot your Password" link, which displays different error messages for existing and non-existing users. This could allow remote attackers to guess valid usernames.

Recommendations For CA Unicenter Management Portal versions 2.0 through 3.1, consider modifying the error messages displayed by the "Forgot your Password" link to be generic, avoiding the disclosure of username existence. As a temporary workaround, restrict access to the "Forgot your Password" link until a more permanent solution is implemented.

Correção

Identificadores relacionados

CVE-2004-1697

Produtos afetados

Ca Unicenter Management Portal

Referências · 5

• http://marc.info/?l=bugtraq&m=109579952809320&w=2 · Nota
• http://secunia.com/advisories/12620 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17464 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2004-1697 · Nota de Segurança
• http://securityfocus.com/bid/11229 · Aviso do Fabricante