The remote web server is affected by an information disclosure issue. Description: The version of WebCalendar on the remote host is prone to a user account enumeration weakness in that in response to login attempts it returns different error messages depending on whether the user exists or the password is invalid.

Upgrade to WebCalendar 1.0.4 or later. CVSS Base Score : 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)

• http://sourceforge.net/project/shownotes.php?group_id=3870&release_id=423010
• http://www.securityfocus.com/archive/1/433053/30/0/threaded
• http://www.securityfocus.com/archive/1/436263/30/0/threaded

---

Updated on 2015-03-25