CVE-2017-16629

Name of the Vulnerable Software and Affected Versions SapphireIMS version 4097 1

Description The software is susceptible to username guessing due to distinct error messages for incorrect usernames and correct usernames with incorrect passwords. For an "Incorrect User", it displays "The application failed to identify the user. Please contact administrator for help." For a "Correct User and Incorrect Password", it shows "Authentication failed. Please login again."

Recommendations For SapphireIMS version 4097 1, consider modifying the login form to provide generic error messages that do not distinguish between incorrect usernames and correct usernames with incorrect passwords, thereby preventing attackers from guessing registered usernames.