CVE-2021-44155

Description

An issue was discovered in /goform/login_process in Reprise RLM 14.2. When an attacker attempts to login, the response if a username is valid includes Login Failed, but does not include this string if the username is invalid. This allows an attacker to enumerate valid users.

Weakness classification

• nvd@nist.gov: CWE-209

Primary references

• cve@mitre.org — Exploit, Third Party Advisory, VDB Entry
• cve@mitre.org — Patch, Product, Vendor Advisory
• cve@mitre.org — Broken Link
• af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory, VDB Entry
• af854a3a-2127-422b-91ae-364da2661108 — Patch, Product, Vendor Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Broken Link