Uploaded image for project: 'mod-login'
  1. mod-login
  2. MODLOGIN-164

Login allows username and password enumeration

    XMLWordPrintable

    Details

    • Type: Bug
    • Status: Open (View Workflow)
    • Priority: TBD
    • Resolution: Unresolved
    • Affects Version/s: None
    • Fix Version/s: None
    • Template:
      Standard Bug Write-Up Format
    • Development Team:
      Core: Platform

      Description

      From security perspective, below are not good practices. Please use message without disclosing specific information. For example: "Login unsuccessful".

      • Try to login with an invalid username "abc". The system returns specific error message
        • Error verifying user existence: No user found by username abc
      • Try to login with a valid username but wrong password. The system returns specific error message
        • Password does not match

       

        TestRail: Results

          Attachments

            Activity

              People

              Assignee:
              adam Adam Dickmeiss
              Reporter:
              hji Hongwei Ji
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

                Dates

                Created:
                Updated:

                  TestRail: Runs

                    TestRail: Cases