Description
DaoAuthenticationProvider in VMware SpringSource Spring Security before 2.0.8, 3.0.x before 3.0.8, and 3.1.x before 3.1.3 does not check the password if the user is not found, which makes the response delay shorter and might allow remote attackers to enumerate valid usernames via a series of login requests.
Remediation
References
http://support.springsource.com/security/CVE-2012-5055
Related Vulnerabilities
CVE-2023-46660 Vulnerability in maven package org.jenkins-ci.plugins:zanata
CVE-2022-46366 Vulnerability in maven package tapestry:tapestry
CVE-2014-0230 Vulnerability in maven package org.apache.tomcat:tomcat-catalina
CVE-2021-4178 Vulnerability in maven package io.fabric8:kubernetes-client
CVE-2023-33246 Vulnerability in maven package org.apache.rocketmq:rocketmq-broker