webcalendar before 1.2.7 shows the reason for a failed login (e.g., "no such user").
The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.
Link | Tags |
---|---|
http://www.openwall.com/lists/oss-security/2013/07/22/8 | third party advisory mailing list |
http://www.openwall.com/lists/oss-security/2013/07/25/4 | third party advisory mailing list |
https://www.securityfocus.com/bid/58250/info | third party advisory vdb entry |