CVE-2017-14772

Skybox Manager Client Application is prone to information disclosure via a username enumeration attack. A local unauthenticated attacker could exploit the flaw to obtain valid usernames, by analyzing error messages upon valid and invalid account login attempts.

Score

CVSS 3.0 3.3 Low

Status

Modified - cve@mitre.org

Published

2017-10-03

Last modified

2024-08-05

Weaknesses

CWE-200

Affected products

• Skybox Manager Client Application (Skyboxsecurity)

References

• http://www.securityfocus.com/bid/101069
• https://lp.skyboxsecurity.com/rs/440-MPQ-510/images/Skybox_Product_Security_Advisory_9_28_17.pdf