« Volver al listado

CVE-2013-6043

Estado: ModificadaMedia (5)—

The login function in Softaculous Webuzo before 2.1.4 provides different error messages for invalid authentication attempts depending on whether the user account exists, which allows remote attackers to enumerate usernames via a series of requests.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Softaculous — Webuzo

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2013-6043",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2014-12-27T18:59:03.650",
  "references": [
    {
      "url": "http://www.softaculous.com/board/index.php?tid=4526&title=Webuzo_2.1.4_Launched",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://web.archive.org/web/20140126212101/http://www.baesystemsdetica.com.au/Research/Advisories/Webuzo-Multiple-Vulnerabilities-%28DS-2013-007%29",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.softaculous.com/board/index.php?tid=4526&title=Webuzo_2.1.4_Launched",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://web.archive.org/web/20140126212101/http://www.baesystemsdetica.com.au/Research/Advisories/Webuzo-Multiple-Vulnerabilities-%28DS-2013-007%29",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The login function in Softaculous Webuzo before 2.1.4 provides different error messages for invalid authentication attempts depending on whether the user account exists, which allows remote attackers to enumerate usernames via a series of requests."
    },
    {
      "lang": "es",
      "value": "La función de login en Softaculous Webuzo anterior a 2.1.4 proporciona mensajes diferentes de error para intentos de autenticación inválidas dependiendo de si la cuenta de usuario existe, lo que permite a atacantes remotos enumerar los nombres de usuario a través de peticiones en serie."
    }
  ],
  "lastModified": "2026-06-16T23:59:56.557",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:softaculous:webuzo:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DBAB3B87-A657-4E3B-95A8-8AB6C7C4B0E7",
              "versionEndIncluding": "2.1.3"
            },
            {
              "criteria": "cpe:2.3:a:softaculous:webuzo:2.1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2A96B062-B8B5-4BE4-A96A-A833812D1051"
            },
            {
              "criteria": "cpe:2.3:a:softaculous:webuzo:2.1.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FD3EFE62-6F84-4610-8CFA-C28AD689AD97"
            },
            {
              "criteria": "cpe:2.3:a:softaculous:webuzo:2.1.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "352DE3B2-5212-42FB-8A78-6C20077EB8F1"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}