Auth bypass in Axway Email Firewall
CVE-2012-6452
Axway Secure Messenger before 6.5 Updated Release 7, as used in Axway Email Firewall, provides different responses to authentication requests depending on whether the user exists, which allows remote attackers to enumerate users via a series of requests.
Vulnerability class: Broken Authentication
EPSS: 0.015 (70.8th percentile) — read the EPSS interpretation.
Affected products
- Axway Email_firewall
- Axway Secure_messenger — versions 6.3.2
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (mailing-list, x_refsource_BUGTRAQ)
- cve@mitre.org (vdb-entry, x_refsource_BID)
- cve@mitre.org (vdb-entry, x_refsource_XF)