{
  "id": "CVE-2009-2435",
  "sourceIdentifier": "cve@mitre.org",
  "published": "2009-07-13T14:30:00.217",
  "lastModified": "2024-11-21T01:04:51.907",
  "vulnStatus": "Modified",
  "descriptions": [
    {
      "lang": "en",
      "value": "The Sametime server in IBM Lotus Instant Messaging and Web Conferencing 6.5.1 generates error messages for a failed logon attempt with different time delays depending on whether the user account exists, which allows remote attackers to enumerate valid usernames."
    },
    {
      "lang": "es",
      "value": "El servidor Sametime de IBM Lotus Instant Messaging and Web Conferencing v6.5.1 genera mensajes de error para los intentos fallidos de inicio de sesi\u00f3n con diferentes retardos de tiempo en funci\u00f3n de si existe la cuenta de usuario o no, lo que permite a atacantes remotos discernir los nombres de usuario v\u00e1lidos."
    }
  ],
  "metrics": {
    "cvssMetricV2": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "2.0",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "baseScore": 5.0,
          "accessVector": "NETWORK",
          "accessComplexity": "LOW",
          "authentication": "NONE",
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "baseSeverity": "MEDIUM",
        "exploitabilityScore": 10.0,
        "impactScore": 2.9,
        "acInsufInfo": false,
        "obtainAllPrivilege": false,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "weaknesses": [
    {
      "source": "nvd@nist.gov",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-255"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:ibm:lotus_instant_messaging_and_web_conferencing:6.5.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "E8AB1206-BD93-41A1-962D-291668678DF9"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "http://www.securityfocus.com/bid/35614",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.senseofsecurity.com.au/advisories/SOS-09-004.pdf",
      "source": "cve@mitre.org",
      "tags": [
        "URL Repurposed"
      ]
    },
    {
      "url": "http://www.securityfocus.com/bid/35614",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.senseofsecurity.com.au/advisories/SOS-09-004.pdf",
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "URL Repurposed"
      ]
    }
  ]
}