53%
39%
23%
IBM WebSphere Application Server 7.0, 8.0, 8.5, 9.0 and Liberty 17.0.0.3 through 21.0.0.9 could allow a remote user to enumerate usernames due to a difference of responses from valid and invalid login attempts. IBM X-Force ID: 205202.
CVSS 3.1 Base Score 5.3. CVSS Attack Vector: network. CVSS Attack Complexity: low. CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
CVSS 2.0 Base Score 5. CVSS Attack Vector: network. CVSS Attack Complexity: low. CVSS Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N).
The following code, extracted from a servlet's doPost() method, performs an authentication lookup every time the servlet is invoked.
int authResult = authenticateUser(username, password);However, the software makes no attempt to restrict excessive authentication attempts.
This code attempts to limit the number of login attempts by causing the process to sleep before completing the authentication.
$isAuthenticated = authenticateUser($username, $password);However, there is no limit on parallel connections, so this does not increase the amount of time an attacker needs to complete an attack.
In the following C/C++ example the validateUser method opens a socket connection, reads a username and password from the socket and attempts to authenticate the username and password.
}
return(SUCCESS);return(FAIL);
}}isValidUser = AuthenticateUser(username, password);The validateUser method will continuously check for a valid username and password without any restriction on the number of authentication attempts made. The method should limit the number of authentication attempts made to prevent brute force attacks as in the following example code.
}
}
count++;}isValidUser = AuthenticateUser(username, password);return(SUCCESS);return(FAIL);ExploitPedia is constantly evolving. Sign up to receive a notification when we release additional functionality.
If you'd like to report a bug or have any suggestions for improvements then please do get in touch with us using this form. We will get back to you as soon as we can.