Information disclosure in Layton Technology Helpbox

CVE-2007-5404

Layton HelpBox 3.7.1 generates different responses depending on whether or not a username is valid in a failed login attempt, which allows remote attackers to enumerate valid usernames.

Vulnerability class: Information Disclosure

EPSS: 0.012 (64.6th percentile) — read the EPSS interpretation.

Affected products

Layton_technology Helpbox — versions 3.7.1
N/a — versions n/a

Weakness classification (CWE)

CWE-200 — Information Disclosure

References

PSIRT-CNA@flexerasoftware.com (x_refsource_MISC)
PSIRT-CNA@flexerasoftware.com (vdb-entry, x_refsource_BID)
PSIRT-CNA@flexerasoftware.com (vdb-entry, x_refsource_XF)
PSIRT-CNA@flexerasoftware.com (x_refsource_SECUNIA, third-party-advisory)