Vulnerability Details CVE-2007-0195
my.activation.php3 in F5 FirePass 5.4 through 5.5.1 and 6.0 displays different error messages for failed login attempts with a valid username than for those with an invalid username, which allows remote attackers to confirm the validity of an LDAP account.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.007
EPSS Ranking 70.3%
CVSS Severity
CVSS v2 Score 5.0
References
- http://lists.grok.org.uk/pipermail/full-disclosure/2007-January/051651.html
- http://secunia.com/advisories/23627
- http://www.mnin.org/advisories/2007_firepass.pdf
- http://www.osvdb.org/32736
- http://www.securityfocus.com/bid/21957
- https://tech.f5.com/home/solutions/sol6923.html
- http://lists.grok.org.uk/pipermail/full-disclosure/2007-January/051651.html
- http://secunia.com/advisories/23627
- http://www.mnin.org/advisories/2007_firepass.pdf
- http://www.osvdb.org/32736
- http://www.securityfocus.com/bid/21957
- https://tech.f5.com/home/solutions/sol6923.html
Products affected by CVE-2007-0195
-
cpe:2.3:h:f5:firepass:5.4
-
cpe:2.3:h:f5:firepass:5.4.1
-
cpe:2.3:h:f5:firepass:5.4.2
-
cpe:2.3:h:f5:firepass:5.4.3
-
cpe:2.3:h:f5:firepass:5.4.4
-
cpe:2.3:h:f5:firepass:5.4.5
-
cpe:2.3:h:f5:firepass:5.4.6
-
cpe:2.3:h:f5:firepass:5.4.7
-
cpe:2.3:h:f5:firepass:5.4.8
-
cpe:2.3:h:f5:firepass:5.4.9
-
cpe:2.3:h:f5:firepass:5.5
-
cpe:2.3:h:f5:firepass:5.5.1
-
cpe:2.3:h:f5:firepass:6.0