CVE-2012-5055

DaoAuthenticationProvider in VMware SpringSource Spring Security before 2.0.8, 3.0.x before 3.0.8, and 3.1.x before 3.1.3 does not check the password if the…

published December 5, 2012

CVSS
—
EPSS
2%
Percentile
80.0
In the wild
Unconfirmed
What it is

DaoAuthenticationProvider in VMware SpringSource Spring Security before 2.0.8, 3.0.x before 3.0.8, and 3.1.x before 3.1.3 does not check the password if the user is not found, which makes the response delay shorter and might allow remote attackers to enumerate valid usernames via a series of login requests.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01952 · 80.0th percentile
Published
2012-12-05T17:00Z
EPSS history
Timeline
  • 05 DEC 17:00Z
    DaoAuthenticationProvider in VMware SpringSource Spring Security before 2.0.8, 3.0.x before 3.0.8, and 3.1.x before 3.1.3 does not check the password if the…
    cvelistv5