Description
DaoAuthenticationProvider in VMware SpringSource Spring Security before 2.0.8, 3.0.x before 3.0.8, and 3.1.x before 3.1.3 does not check the password if the user is not found, which makes the response delay shorter and might allow remote attackers to enumerate valid usernames via a series of login requests.
Remediation
References
http://support.springsource.com/security/CVE-2012-5055
Related Vulnerabilities
CVE-2019-1003086 Vulnerability in maven package org.jenkins-ci.plugins:sinatra-chef-builder
CVE-2023-43643 Vulnerability in maven package org.owasp.antisamy:antisamy
CVE-2015-2575 Vulnerability in maven package mysql:mysql-connector-java
CVE-2022-34802 Vulnerability in maven package org.jenkins-ci.plugins:rocketchatnotifier
CVE-2021-26544 Vulnerability in maven package org.apache.livy:livy-server