Kentico CMS Username Enumeration Weakness

Bugtraq ID:	66125
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Mar 09 2014 12:00AM
Updated:	Mar 17 2014 01:04AM
Credit:	Charlie Campbell, Lyndon Mendoza
Vulnerable:
Not Vulnerable:

Kentico CMS Username Enumeration Weakness

Kentico CMS is prone to a username-enumeration weakness.

Attackers may exploit this weakness to discern valid usernames, which may aid them in brute-force password cracking or other attacks.

Kentico CMS 7.0.75 and prior are vulnerable.

Kentico CMS Username Enumeration Weakness

Attackers can use a web browser and readily available tools to exploit this issue.

Kentico CMS Username Enumeration Weakness

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Kentico CMS Username Enumeration Weakness

References:

• Kentico CMS Release Notes (Kentico)