CVE-2012-5055 — Vulnetix

Try Vulnetix Request Demo

CVE-2012-5055 PUBLISHED CVSS 5 MEDIUM

DaoAuthenticationProvider in VMware SpringSource Spring Security before 2.0.8, 3.0.x before 3.0.8, and 3.1.x before 3.1.3 does not check the password if the user is not found, which makes the response delay shorter and might allow remote attackers to enumerate valid usernames via a series of login requests.

EPSS 0.36% · 57.9th percentile

Risk Scores

CVSS v2.0

5

EPSS Score

0.36%

57.9th percentile

Affected Products

Vendor	Product	Versions
vmware	springsource_spring_security	3.1.2, 3.0.3, 3.0.4
n/a	n/a	n/a
Maven	org.springframework.security:spring-security-core	0, 3.0.0, 3.1.0

Timeline

Dec 5, 2012 CVE Published
Dec 28, 2012 CVE Updated
Feb 4, 2022 EPSS Score
Mar 28, 2022 EPSS Score
May 19, 2022 EPSS Score
Jul 10, 2022 EPSS Score
Sep 1, 2022 EPSS Score
Oct 23, 2022 EPSS Score
Dec 14, 2022 EPSS Score
Feb 4, 2023 EPSS Score
Mar 7, 2023 EPSS Score
Mar 28, 2023 EPSS Score

References

Open in Interactive Console →