Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
The PlexTrac platform prior to version 1.28.0 allows for username enumeration via HTTP response times on invalid login attempts for users configured to use the PlexTrac authentication provider. Login attempts for valid, unlocked users configured to use PlexTrac as their authentication provider take significantly longer than those for invalid users, allowing for valid users to be enumerated by an unauthenticated remote attacker. Note that the lockout policy implemented in Plextrac version 1.17.0 makes it impossible to distinguish between valid, locked user accounts and user accounts that do not exist, but does not prevent valid, unlocked users from being enumerated.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
PlexTrac 安全漏洞
Vulnerability Description
PlexTrac是美国PlexTrac公司的一个渗透测试报告和管理平台。 PlexTrac platform 1.28.0之前版本存在安全漏洞，该漏洞源于允许通过HTTP响应时间对配置为使用PlexTrac身份验证提供程序的用户进行无效登录尝试进行用户名枚举。配置为使用PlexTrac作为其身份验证提供程序的有效、未锁定用户的登录尝试比无效用户的登录尝试花费的时间要长得多，从而允许未经身份验证的远程攻击者枚举有效用户。
CVSS Information
N/A
Vulnerability Type
N/A