CVE-2018-1154
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk49th percentile - higher than 49% of all known CVEs
Summary
In SecurityCenter versions prior to 5.7.0, a username enumeration issue allows an unauthenticated attacker to automate discovery of username aliases via brute force, potentially facilitating unauthorized access.
Risk Assessment
An attacker can use username enumeration to conduct brute-force password attacks, increasing the risk of unauthorized access to the system.
Recommendation
Upgrade SecurityCenter to version 5.7.0 or later, which unifies server responses to mitigate the issue.
Other vulnerabilities in Tenable SecurityCenter
See all- CVE-2018-1155Medium
In SecurityCenter versions prior to 5.7.0, a cross-site scripting (XSS) issue allows an authenticated attacker to inject JavaScript code into an image filename parameter within the Reports feature area.
- CVE-2013-5911Medium
A cross-site scripting (XSS) vulnerability in devform.php in Tenable SecurityCenter 4.6 through 4.7 allows remote attackers to inject arbitrary web script or HTML via the message parameter.
Original NVD description (English source)
In SecurityCenter versions prior to 5.7.0, a username enumeration issue could allow an unauthenticated attacker to automate the discovery of username aliases via brute force, ultimately facilitating unauthorized access. Server response output has been unified to correct this issue.