← Back

CVE-2018-15919

nvd nist
Published: Aug 28, 2018Modified: Dec 18, 2025

JSON object

Loading...
5.3
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Exploitability: 3.9 / Impact: 1.4
Source: NVD

Description

Remotely observable behaviour in auth-gss2.c in OpenSSH through 7.8 could be used by remote attackers to detect existence of users on a target system when GSS2 is in use. NOTE: the discoverer states 'We understand that the OpenSSH developers do not want to treat such a username enumeration (or "oracle") as a vulnerability.'

Affected (6)

Openbsd
1 product
Openssh
Netapp
5 products
Cloud Backup
Data Ontap Edge
Ontap Select Deploy
Steelstore
Cn1610 Firmware
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Openssh
From 5.9 to 7.8
Configuration B
4 vulnerable
Vulnerable SoftwareAffected Versions
Cloud Backup
All versions
Data Ontap Edge
All versions
Ontap Select Deploy
All versions
Steelstore
All versions
Configuration C
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Cn1610 Firmware
All versions
Running on/withPlatform Versions
Netapp
Cn1610
All versions

Related CWEs

CWE-200
Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (6)

Source: cve@mitre.org
Mailing ListPatchThird Party Advisory
Source: cve@mitre.org
Third Party AdvisoryVDB Entry
Source: cve@mitre.org
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListPatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party AdvisoryVDB Entry
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory

Timeline

No history available yet.