CVE-2012-5055
Vulnerability from cvelistv5
Published
2012-12-05 17:00
Modified
2024-09-16 23:11
Severity ?
EPSS score ?
Summary
DaoAuthenticationProvider in VMware SpringSource Spring Security before 2.0.8, 3.0.x before 3.0.8, and 3.1.x before 3.1.3 does not check the password if the user is not found, which makes the response delay shorter and might allow remote attackers to enumerate valid usernames via a series of login requests.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://support.springsource.com/security/CVE-2012-5055 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://support.springsource.com/security/CVE-2012-5055 | Vendor Advisory |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T20:50:18.354Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://support.springsource.com/security/CVE-2012-5055"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "DaoAuthenticationProvider in VMware SpringSource Spring Security before 2.0.8, 3.0.x before 3.0.8, and 3.1.x before 3.1.3 does not check the password if the user is not found, which makes the response delay shorter and might allow remote attackers to enumerate valid usernames via a series of login requests."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2012-12-05T17:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://support.springsource.com/security/CVE-2012-5055"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2012-5055",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "DaoAuthenticationProvider in VMware SpringSource Spring Security before 2.0.8, 3.0.x before 3.0.8, and 3.1.x before 3.1.3 does not check the password if the user is not found, which makes the response delay shorter and might allow remote attackers to enumerate valid usernames via a series of login requests."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://support.springsource.com/security/CVE-2012-5055",
"refsource": "CONFIRM",
"url": "http://support.springsource.com/security/CVE-2012-5055"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2012-5055",
"datePublished": "2012-12-05T17:00:00Z",
"dateReserved": "2012-09-21T00:00:00Z",
"dateUpdated": "2024-09-16T23:11:00.174Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2012-5055\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2012-12-05T17:55:01.663\",\"lastModified\":\"2024-11-21T01:43:56.507\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"DaoAuthenticationProvider in VMware SpringSource Spring Security before 2.0.8, 3.0.x before 3.0.8, and 3.1.x before 3.1.3 does not check the password if the user is not found, which makes the response delay shorter and might allow remote attackers to enumerate valid usernames via a series of login requests.\"},{\"lang\":\"es\",\"value\":\"DaoAuthenticationProvider en VMware SpringSource Spring Security antes de v2.0.8, v3.0.x antes de v3.0.8, y v3.1.x antes de v3.1.3 no comprueba la contrase\u00f1a si el usuario no se encuentra, lo que hace que la respuesta de retardo sea menor y podr\u00eda permitir a atacantes remotos para enumerar los nombres de usuario v\u00e1lidos a trav\u00e9s de una serie de solicitudes de inicio de sesi\u00f3n.\"}],\"metrics\":{\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:P/I:N/A:N\",\"baseScore\":5.0,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":10.0,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-200\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:springsource_spring_security:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"2.0.6\",\"matchCriteriaId\":\"D0758437-7387-404F-9AC8-DFE044F713D8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:springsource_spring_security:2.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"49404CD7-2E0D-479C-AAC4-0B84AEFB724E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:springsource_spring_security:2.0.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4D78BB50-F222-46BC-AEAA-8B1DADE2E38C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:springsource_spring_security:2.0.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"49CC9A95-6EA8-4F95-BBD1-D306D831636D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:springsource_spring_security:2.0.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0F694360-D48E-4ECB-9B32-8A83803E0A68\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:springsource_spring_security:2.0.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3EE84C44-3D48-4F5B-B168-80F583E84C04\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:springsource_spring_security:2.0.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6C672302-C952-4EC0-A833-34382F7CC47A\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:springsource_spring_security:3.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D802BACB-E48F-4430-9C93-5029B596DDBA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:springsource_spring_security:3.0.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FED53F75-200C-40F4-A282-E0DBDBDB4DE1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:springsource_spring_security:3.0.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0DD07175-064C-46D2-B76A-17A642FB7D75\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:springsource_spring_security:3.0.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E96BD784-6C39-4FC2-AF5D-C21465D17925\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:springsource_spring_security:3.0.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"08A9A32B-E092-4016-8D63-4CAA52FA8421\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:springsource_spring_security:3.0.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8F42E395-9775-4F37-90EF-9AD2B0FF7CD0\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:springsource_spring_security:3.1.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"86B12DA8-FFBF-4BCA-8485-18083BA1D827\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:springsource_spring_security:3.1.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0C9F1EA7-CFE0-41AE-9A17-6DACD04F17EE\"}]}]}],\"references\":[{\"url\":\"http://support.springsource.com/security/CVE-2012-5055\",\"source\":\"cve@mitre.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://support.springsource.com/security/CVE-2012-5055\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]}]}}"
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.