PT-2021-12849 · Squaredup · Squaredup

Published 2021-02-03 · Updated 2022-02-22 · CVE-2020-9389

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions: SquaredUp versions prior to 4.6.0

Description: A username enumeration issue was discovered in the login functionality, allowing a malicious user to guess valid usernames due to different response times from invalid usernames.

Recommendations: For versions prior to 4.6.0, update to version 4.6.0 or later to resolve the issue. As a temporary workaround, consider implementing rate limiting or IP blocking to minimize the risk of exploitation. Restrict access to the login functionality to trusted users and networks until the update is applied.

Fix

Side Channel Attack

Weakness Enumeration

CWE-203

Related Identifiers

CVE-2020-9389

Affected Products

Squaredup

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2020-9389 · Security Note
• https://support.squaredup.com/hc/en-us/articles/360019427238-CVE-2020-9389-Username-enumeration-possible-via-a-timing-attack · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-9389 · Vendor Advisory
• https://support.squaredup.com/hc/en-us/articles/360017255858 · Vendor Advisory
• https://t.me/cibsecurity/23038 · Telegram Post
• https://t.me/cvenotify/14575 · Telegram Post