PT-2021-11884
CVE-2020-35952
·
تاريخ النشر
2021-01-03
·
تاريخ التحديث
2021-01-11
الوصف من
CVSS 3.1
6.5
متوسطةالمقاييسAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions:
PHPFusion (aka PHP-Fusion) Andromeda versions 9.x before 2020-12-30
Description:
The issue arises from the
login.php file generating distinct error messages for incorrect usernames and passwords, rather than a unified message. This distinction might allow for enumeration.Recommendations:
For PHPFusion (aka PHP-Fusion) Andromeda versions 9.x before 2020-12-30, update to a version released after 2020-12-30 to resolve the issue. As a temporary workaround, consider modifying the
login.php file to display a single, unified error message for both incorrect usernames and passwords, thus preventing potential enumeration. وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾