Secunia

Thomas Adams has reported a weakness in UniCenter Management Portal, which can be exploited by malicious people to disclose system information.

The problem is caused due to an error in the "Forgot Password" feature, which discloses information about usernames. This can be exploited by supplying an arbitrary username and then checking the error response in order to determine whether the username exists or not.

The weakness has been reported in versions 2.0 and 3.1. Other versions may also be affected.

Solution
Disable the "Forgot Password" feature or restrict access to the portal.
Further details available in Customer Area

Provided and/or discovered by
Thomas Adams

Changelog
Further details available in Customer Area

Deep Links
Links available in Customer Area