Vulnerabilities > CVE-2020-7962 - Information Exposure Through Discrepancy vulnerability in Oneidentity Password Manager 5.8
Attack vector
NETWORK Attack complexity
LOW Privileges required
NONE Confidentiality impact
LOW Integrity impact
NONE Availability impact
NONE Summary
An issue was discovered in One Identity Password Manager 5.8. An attacker could enumerate valid answers for a user. It is possible for an attacker to detect a valid answer based on the HTTP response content, and reuse this answer later for a password reset on a chosen password. The enumeration is possible because, within the HTTP response content, WRONG ID is only returned when the answer is incorrect.
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| Application | 1 |