Lucene search
HistoryOct 03, 2022 - 4:23 p.m.
CVE-2009-1803
cve-2009-1803
freepbx
security
vulnerability
remote attackers
user enumeration
5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:N/A:N
6.9 Medium
AI Score
Confidence
Low
0.004 Low
EPSS
Percentile
73.7%
FreePBX 2.5.1, and other 2.4.x, 2.5.x, and pre-release 2.6.x versions, generates different error messages for a failed login attempt depending on whether the user account exists, which allows remote attackers to enumerate valid usernames.
Affected configurations
Node
freepbxfreepbxMatch2.4
ORfreepbxfreepbxMatch2.4.0_beta1
ORfreepbxfreepbxMatch2.4.0_beta2
ORfreepbxfreepbxMatch2.4.1
ORfreepbxfreepbxMatch2.5
ORfreepbxfreepbxMatch2.5.0_beta1
ORfreepbxfreepbxMatch2.5.0rc2
ORfreepbxfreepbxMatch2.5.0rc3
ORfreepbxfreepbxMatch2.5.1
ORfreepbxfreepbxMatch2.5.2
ORsangomafreepbxMatch2.4.0
ORsangomafreepbxMatch2.5.0
Related
prion
prion
Code injection
2009-05-28 14:30:00
cvelist
cvelist
CVE-2009-1803
2022-10-03 16:23:57
nvd
nvd
CVE-2009-1803
2009-05-28 14:30:00
5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:N/A:N
6.9 Medium
AI Score
Confidence
Low
0.004 Low
EPSS
Percentile
73.7%
Related for CVE-2009-1803