Description
IBM Tivoli Provisioning Manager Express provides unspecified information in error messages when (1) attempted duplication of a username occurs when creating an account or (2) when trying to login using a valid username, which makes it easier for remote attackers to enumerate usernames.
References
- 20071205 [ELEYTT] Public Advisory 05-12-2007 mailing-list
- provisioningmanager-user-info-disclosure(38866) vdb-entry
- 3458 third-party-advisory
- 26724 vdb-entry