Description (CNA)
Tibbo AggreGate Network Manager < 6.40.05 contains an observable response discrepancy in its login functionality. Authentication failure messages differ based on whether a supplied username exists or not, allowing an unauthenticated remote attacker to infer valid account identifiers. This can facilitate user enumeration and increase the likelihood of targeted brute-force or credential-stuffing attacks.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Tibbo Systems / AggreGate Network Manager | affected 0 before 6.40.05 |
CWE
CWE-204
References
- https://aggregate.digital/downloads.html
- https://aggregate.digital/products/network-manager.html
- https://www.vulncheck.com/advisories/tibbo-aggregate-network-manager-login-functionality-user-enumeration
ADP enrichment
No English description supplied.
No references supplied.