Secunia

David Maciejak has discovered a weakness in WebCalendar, which can be exploited by malicious people to identify valid user accounts.

The problem is that different error messages are returned depending on whether an unsuccessful login attempt is performed with a valid or invalid username in the login page.

The weakness has been confirmed in version 1.0.3 and has also been reported in versions 1.0.1 and 1.0.2. Other versions may also be affected.

Solution
Edit the source code to ensure that a single general error message is returned on a failed login.

Provided and/or discovered by
David Maciejak

Changelog
Further details available in Customer Area

Deep Links
Links available in Customer Area