Summary
This host is installed with TYPO3 and is prone to username disclosure vulnerability.
Impact
Successful exploitation will allow remote attackers to obtain valid usernames.
Impact Level: Application
Solution
Upgrade to TYPO3 version 4.3.12, 4.4.9 or 4.5.4 or later, For updates refer to http://typo3.org
Insight
An error exists in application, which returns a different response for incorrect authentication attempts depending on whether or not the username is incorrect
Affected
TYPO3 version before 4.3.11 and below, 4.4.8 and below, 4.5.3 and below
Detection
Send a Crafted HTTP POST request and check whether it is able to get sensitive information.
References
Severity
Classification
-
CVSS Base Score: 7.5
AV:N/AC:L/Au:N/C:P/I:P/A:P
Related Vulnerabilities
- ArticleFR CMS 'id' Parameter SQL Injection Vulnerability
- ALCASAR Remote Code Execution Vulnerability
- AlstraSoft AskMe Pro 'forum_answer.php' and 'profile.php' Multiple SQL Injection Vulnerabilities
- Artifectx xClassified 'catid' SQL Injection Vulnerability
- Apache Tomcat AJP Protocol Security Bypass Vulnerability