PT-2008-1484 · Layton · Layton Helpbox

Published 2008-01-09 · Updated 2017-07-29 · CVE-2007-5404

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Layton HelpBox version 3.7.1

Description The issue allows remote attackers to enumerate valid usernames by analyzing different responses from failed login attempts. This is possible because the system generates distinct responses based on whether a username is valid or not.

Recommendations For Layton HelpBox version 3.7.1, consider modifying the login failure response to make it identical for both valid and invalid usernames, thereby preventing username enumeration. As a temporary workaround, restrict access to the login functionality to minimize the risk of exploitation.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2007-5404

Affected Products

Layton Helpbox

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2007-5404 · Security Note
• http://securityfocus.com/bid/27187 · Note
• http://secunia.com/secunia_research/2007-94/advisory · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/39544 · Note
• http://secunia.com/advisories/27699 · Note