Detections
Analytics

Drupal User Enumeration

medium Web App Scanning Plugin ID 98209

Language:

Synopsis

Drupal User Enumeration

Description

In some default Drupal installations there are methods which may allow attackers to enumerate a authors username. This information may then be used in brute-force or dictionary attacks against the login form in order to guess passwords.

Solution

Block requests to sensitive user information at the server using .htaccess file or WAF for example. You should block or redirect all requests made to '/user/reset/'.

See Also

https://www.drupal.org/project/htaccess

Plugin Details

Severity: Medium

ID: 98209

Type: remote

Published: 3/21/2018

Updated: 11/17/2023

Scan Template: basic, full, pci, scan

Risk Information

VPR

Risk Factor: Low

Score: 2.2

CVSS v2

Risk Factor: Medium

Base Score: 5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS Score Source: Tenable

CVSS v3

Risk Factor: Medium

Base Score: 5.3

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CVSS Score Source: Tenable

Reference Information