Vulnerability in IBM Lotus Instant Messaging And Web Conferencing
CVE-2009-2435
The Sametime server in IBM Lotus Instant Messaging and Web Conferencing 6.5.1 generates error messages for a failed logon attempt with different time delays depending on whether the user account exists, which allows remote attackers to enumerate valid usernames.
EPSS: 0.011 (61.2th percentile) — read the EPSS interpretation.
Affected products
- Ibm Lotus_instant_messaging_and_web_conferencing — versions 6.5.1
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (URL Repurposed, x_refsource_MISC)
- cve@mitre.org (vdb-entry, x_refsource_BID)