PT-2008-2759 · Flyspray · Flyspray

Published 2008-03-05 · Updated 2018-10-11 · CVE-2008-1166

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Flyspray version 0.9.9.4

Description The issue allows remote attackers to enumerate usernames by generating different error messages depending on whether the username is valid or invalid.

Recommendations For Flyspray version 0.9.9.4, consider modifying the error handling mechanism to return generic error messages, avoiding the disclosure of username validity.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2008-1166

Affected Products

Flyspray

References · 5

• http://secunia.com/advisories/29215 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-1166 · Security Note
• http://securityfocus.com/archive/1/489020/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/40964 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1166 · Note