{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "descriptions": [{"lang": "en", "value": "DaoAuthenticationProvider in VMware SpringSource Spring Security before 2.0.8, 3.0.x before 3.0.8, and 3.1.x before 3.1.3 does not check the password if the user is not found, which makes the response delay shorter and might allow remote attackers to enumerate valid usernames via a series of login requests."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2012-12-05T17:00:00Z", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "http://support.springsource.com/security/CVE-2012-5055"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2012-5055", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "DaoAuthenticationProvider in VMware SpringSource Spring Security before 2.0.8, 3.0.x before 3.0.8, and 3.1.x before 3.1.3 does not check the password if the user is not found, which makes the response delay shorter and might allow remote attackers to enumerate valid usernames via a series of login requests."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "http://support.springsource.com/security/CVE-2012-5055", "refsource": "CONFIRM", "url": "http://support.springsource.com/security/CVE-2012-5055"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T20:50:18.354Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://support.springsource.com/security/CVE-2012-5055"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2012-5055", "datePublished": "2012-12-05T17:00:00Z", "dateReserved": "2012-09-21T00:00:00Z", "dateUpdated": "2024-09-16T23:11:00.174Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:vmware:springsource_spring_security:*:*:*:*:*:*:*:*", "matchCriteriaId": "D0758437-7387-404F-9AC8-DFE044F713D8", "versionEndIncluding": "2.0.6", "vulnerable": true}, {"criteria": "cpe:2.3:a:vmware:springsource_spring_security:2.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "49404CD7-2E0D-479C-AAC4-0B84AEFB724E", "vulnerable": true}, {"criteria": "cpe:2.3:a:vmware:springsource_spring_security:2.0.1:*:*:*:*:*:*:*", "matchCriteriaId": "4D78BB50-F222-46BC-AEAA-8B1DADE2E38C", "vulnerable": true}, {"criteria": "cpe:2.3:a:vmware:springsource_spring_security:2.0.2:*:*:*:*:*:*:*", "matchCriteriaId": "49CC9A95-6EA8-4F95-BBD1-D306D831636D", "vulnerable": true}, {"criteria": "cpe:2.3:a:vmware:springsource_spring_security:2.0.3:*:*:*:*:*:*:*", "matchCriteriaId": "0F694360-D48E-4ECB-9B32-8A83803E0A68", "vulnerable": true}, {"criteria": "cpe:2.3:a:vmware:springsource_spring_security:2.0.4:*:*:*:*:*:*:*", "matchCriteriaId": "3EE84C44-3D48-4F5B-B168-80F583E84C04", "vulnerable": true}, {"criteria": "cpe:2.3:a:vmware:springsource_spring_security:2.0.5:*:*:*:*:*:*:*", "matchCriteriaId": "6C672302-C952-4EC0-A833-34382F7CC47A", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:vmware:springsource_spring_security:3.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "D802BACB-E48F-4430-9C93-5029B596DDBA", "vulnerable": true}, {"criteria": "cpe:2.3:a:vmware:springsource_spring_security:3.0.1:*:*:*:*:*:*:*", "matchCriteriaId": "FED53F75-200C-40F4-A282-E0DBDBDB4DE1", "vulnerable": true}, {"criteria": "cpe:2.3:a:vmware:springsource_spring_security:3.0.2:*:*:*:*:*:*:*", "matchCriteriaId": "0DD07175-064C-46D2-B76A-17A642FB7D75", "vulnerable": true}, {"criteria": "cpe:2.3:a:vmware:springsource_spring_security:3.0.3:*:*:*:*:*:*:*", "matchCriteriaId": "E96BD784-6C39-4FC2-AF5D-C21465D17925", "vulnerable": true}, {"criteria": "cpe:2.3:a:vmware:springsource_spring_security:3.0.4:*:*:*:*:*:*:*", "matchCriteriaId": "08A9A32B-E092-4016-8D63-4CAA52FA8421", "vulnerable": true}, {"criteria": "cpe:2.3:a:vmware:springsource_spring_security:3.0.5:*:*:*:*:*:*:*", "matchCriteriaId": "8F42E395-9775-4F37-90EF-9AD2B0FF7CD0", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:vmware:springsource_spring_security:3.1.1:*:*:*:*:*:*:*", "matchCriteriaId": "86B12DA8-FFBF-4BCA-8485-18083BA1D827", "vulnerable": true}, {"criteria": "cpe:2.3:a:vmware:springsource_spring_security:3.1.2:*:*:*:*:*:*:*", "matchCriteriaId": "0C9F1EA7-CFE0-41AE-9A17-6DACD04F17EE", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "DaoAuthenticationProvider in VMware SpringSource Spring Security before 2.0.8, 3.0.x before 3.0.8, and 3.1.x before 3.1.3 does not check the password if the user is not found, which makes the response delay shorter and might allow remote attackers to enumerate valid usernames via a series of login requests."}, {"lang": "es", "value": "DaoAuthenticationProvider en VMware SpringSource Spring Security antes de v2.0.8, v3.0.x antes de v3.0.8, y v3.1.x antes de v3.1.3 no comprueba la contrase\u00f1a si el usuario no se encuentra, lo que hace que la respuesta de retardo sea menor y podr\u00eda permitir a atacantes remotos para enumerar los nombres de usuario v\u00e1lidos a trav\u00e9s de una serie de solicitudes de inicio de sesi\u00f3n."}], "id": "CVE-2012-5055", "lastModified": "2024-11-21T01:43:56.507", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2012-12-05T17:55:01.663", "references": [{"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "http://support.springsource.com/security/CVE-2012-5055"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://support.springsource.com/security/CVE-2012-5055"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2013:0649", "cpe": "cpe:/a:redhat:fuse_esb_enterprise:7.1.0", "product_name": "Fuse ESB Enterprise 7.1.0", "release_date": "2013-03-14T00:00:00Z"}], "bugzilla": {"description": "Security: Ability to determine if username is valid via DaoAuthenticationProvider", "id": "886031", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=886031"}, "csaw": false, "cvss": {"cvss_base_score": "2.6", "cvss_scoring_vector": "AV:N/AC:H/Au:N/C:P/I:N/A:N", "status": "verified"}, "details": ["DaoAuthenticationProvider in VMware SpringSource Spring Security before 2.0.8, 3.0.x before 3.0.8, and 3.1.x before 3.1.3 does not check the password if the user is not found, which makes the response delay shorter and might allow remote attackers to enumerate valid usernames via a series of login requests."], "name": "CVE-2012-5055", "public_date": "2012-10-09T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2012-5055\nhttps://nvd.nist.gov/vuln/detail/CVE-2012-5055"], "threat_severity": "Low"}