PT-2021-8563 · Unknown · Sapphireims

Tanoy Bose · Published 2021-08-11 · Updated 2021-08-12 · CVE-2017-16629

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions SapphireIMS version 4097 1

Description The software is susceptible to username guessing due to distinct error messages for incorrect usernames and correct usernames with incorrect passwords. For an "Incorrect User", it displays "The application failed to identify the user. Please contact administrator for help." For a "Correct User and Incorrect Password", it shows "Authentication failed. Please login again."

Recommendations For SapphireIMS version 4097 1, consider modifying the login form to provide generic error messages that do not distinguish between incorrect usernames and correct usernames with incorrect passwords, thereby preventing attackers from guessing registered usernames.

Fix

Generation of Error Message Containing Sensitive Information

Weakness Enumeration

CWE-209

Related Identifiers

CVE-2017-16629

Affected Products

Sapphireims

References · 5

• https://osv.dev/vulnerability/CVE-2017-16629 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-16629 · Security Note
• https://vuln.shellcoder.party/2020/07/18/cve-2017-16629-sapphireims-login-page-information-disclosure · Note
• https://t.me/cibsecurity/27202 · Telegram Post
• https://vuln.shellcoder.party/tags/sapphireims · Note