Description
DaoAuthenticationProvider in VMware SpringSource Spring Security before 2.0.8, 3.0.x before 3.0.8, and 3.1.x before 3.1.3 does not check the password if the user is not found, which makes the response delay shorter and might allow remote attackers to enumerate valid usernames via a series of login requests.
Remediation
References
http://support.springsource.com/security/CVE-2012-5055
Related Vulnerabilities
CVE-2017-1000242 Vulnerability in maven package org.jenkins-ci.plugins:git-client
CVE-2019-10170 Vulnerability in maven package org.keycloak:keycloak-services
CVE-2023-37478 Vulnerability in npm package @pnpm/win-x64
CVE-2017-2606 Vulnerability in maven package org.jenkins-ci.main:jenkins-core
CVE-2021-21618 Vulnerability in maven package org.jenkins-ci.plugins:repository-connector