{"api_version":"1","generated_at":"2026-07-24T19:44:34+00:00","cve":"CVE-2018-14597","urls":{"html":"https://cve.report/CVE-2018-14597","api":"https://cve.report/api/cve/CVE-2018-14597.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2018-14597","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2018-14597"},"summary":{"title":"CVE-2018-14597","description":"CA Technologies Identity Governance 12.6, 14.0, 14.1, and 14.2 and CA Identity Suite Virtual Appliance 14.0, 14.1, and 14.2 provide telling error messages that may allow remote attackers to enumerate account names.","state":"PUBLIC","assigner":"vuln@ca.com","published_at":"2018-10-17 21:49:00","updated_at":"2019-10-09 23:35:00"},"problem_types":["CWE-200"],"metrics":[],"references":[{"url":"http://www.securityfocus.com/bid/105688","name":"105688","refsource":"BID","tags":["Third Party Advisory","VDB Entry"],"title":"Malformed Request","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://support.ca.com/us/product-content/recommended-reading/security-notices/ca20181017-01-security-notice-for-ca-identity-governance.html","name":"https://support.ca.com/us/product-content/recommended-reading/security-notices/ca20181017-01-security-notice-for-ca-identity-governance.html","refsource":"CONFIRM","tags":["Patch","Vendor Advisory"],"title":"CA20181017-01: Security Notice for CA Identity Governance","mime":"text/html","httpstatus":"500","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-14597","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-14597","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2018","cve_id":"14597","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"broadcom","cpe5":"ca_identity_governance","cpe6":"12.6","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2018","cve_id":"14597","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"broadcom","cpe5":"ca_identity_governance","cpe6":"12.6","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2018","cve_id":"14597","vulnerable":"1","versionEndIncluding":"14.2","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"broadcom","cpe5":"ca_identity_governance","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2018","cve_id":"14597","vulnerable":"1","versionEndIncluding":"14.2","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"broadcom","cpe5":"ca_identity_suite_virtual_appliance","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"vuln@ca.com","ID":"CVE-2018-14597","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"CA Identity Governance","version":{"version_data":[{"version_value":"14.x"}]}}]},"vendor_name":"CA Technologies"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"CA Technologies Identity Governance 12.6, 14.0, 14.1, and 14.2 and CA Identity Suite Virtual Appliance 14.0, 14.1, and 14.2 provide telling error messages that may allow remote attackers to enumerate account names."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-203: Information Exposure Through Discrepancy"}]}]},"references":{"reference_data":[{"name":"https://support.ca.com/us/product-content/recommended-reading/security-notices/ca20181017-01-security-notice-for-ca-identity-governance.html","refsource":"CONFIRM","url":"https://support.ca.com/us/product-content/recommended-reading/security-notices/ca20181017-01-security-notice-for-ca-identity-governance.html"},{"name":"105688","refsource":"BID","url":"http://www.securityfocus.com/bid/105688"}]},"source":{"discovery":"UNKNOWN"}},"nvd":{"publishedDate":"2018-10-17 21:49:00","lastModifiedDate":"2019-10-09 23:35:00","problem_types":["CWE-200"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM"},"exploitabilityScore":3.9,"impactScore":1.4},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":5},"severity":"MEDIUM","exploitabilityScore":10,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:broadcom:ca_identity_governance:12.6:*:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:broadcom:ca_identity_governance:*:*:*:*:*:*:*:*","versionStartIncluding":"14.0","versionEndIncluding":"14.2","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:broadcom:ca_identity_suite_virtual_appliance:*:*:*:*:*:*:*:*","versionStartIncluding":"14.0","versionEndIncluding":"14.2","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2018","CveId":"14597","Ordinal":"131303","Title":"CVE-2018-14597","CVE":"CVE-2018-14597","Year":"2018"},"notes":[{"CveYear":"2018","CveId":"14597","Ordinal":"1","NoteData":"CA Technologies Identity Governance 12.6, 14.0, 14.1, and 14.2 and CA Identity Suite Virtual Appliance 14.0, 14.1, and 14.2 provide telling error messages that may allow remote attackers to enumerate account names.","Type":"Description","Title":null},{"CveYear":"2018","CveId":"14597","Ordinal":"2","NoteData":"2018-10-17","Type":"Other","Title":"Published"},{"CveYear":"2018","CveId":"14597","Ordinal":"3","NoteData":"2018-10-23","Type":"Other","Title":"Modified"}]}}}