CVE-2013-6020 | BDVDB-2026-58235 Detail

Description#

passwordRequestPOST.jsp in Tyler Technologies TaxWeb 3.13.3.1 sends different HTTP status codes for invalid password-recovery requests depending on whether the user account exists, which allows remote attackers to enumerate account names via a series of requests to the (1) Assessor, (2) Recorder, or (3) Treasurer application.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

http://www.kb.cert.org/vuls/id/911678

Exploit#

No public exploit known

History#

Version 12013-10-28Record published in the CVE List.
Version 22024-09-16Most recent update recorded in the CVE List.