low3.7
CVE-2020-9389
A username enumeration issue was discovered in SquaredUp before version 4.6.0.
Impact
A username enumeration issue was discovered in SquaredUp before version 4.6.0. The login functionality was implemented in a way that would enable a malicious user to guess valid username due to a different response time from invalid usernames.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Squaredup | Squaredup | through 4.6 |
Weakness classification
References
- NVD record
- CVE.org record
- https://support.squaredup.com/hc/en-us/articles/360017255858
- https://support.squaredup.com/hc/en-us/articles/360019427238-CVE-2020-9389-Username-enumeration-possible-via-a-timing-attack
- https://support.squaredup.com/hc/en-us/articles/360017255858
- https://support.squaredup.com/hc/en-us/articles/360019427238-CVE-2020-9389-Username-enumeration-possible-via-a-timing-attack