eFront Information Disclosure Vulnerability And User Enumeration Weakness

Bugtraq ID:	53272
Class:	Input Validation Error
CVE:	CVE-2012-6515
Remote:	Yes
Local:	No
Published:	Apr 26 2012 12:00AM
Updated:	Mar 19 2015 07:35AM
Credit:	Jakub Galczyk
Vulnerable:	eFront eFront 3.6.10
Not Vulnerable:

eFront Information Disclosure Vulnerability And User Enumeration Weakness

eFront is prone to an information-disclosure vulnerability and a user-enumeration weakness because it fails to properly sanitize user-supplied input.

Attackers can exploit the information-disclosure vulnerability to obtain sensitive information. Successful exploits may lead to other attacks.

Attackers can exploit user-enumeration weakness harvest valid usernames, which may aid in brute-force attacks.

eFront 3.6.10 is vulnerable; other versions may also be affected.

eFront Information Disclosure Vulnerability And User Enumeration Weakness

Attackers can exploit these issues with a web browser.

eFront Information Disclosure Vulnerability And User Enumeration Weakness

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

eFront Information Disclosure Vulnerability And User Enumeration Weakness

References:

• eFront Homepage (eFront)