Bug #22304
[External Audit Findings][MLEB] User Enumeration through Error Messages
| Status: | New | Start date: | 29 July 2025 | |
|---|---|---|---|---|
| Priority: | Immediate | Due date: | ||
| Assignee: | Tan Hi Ann | % Done: | 0% | |
| Category: | - | Spent time: | - | |
| Target version: | - |
Description
Issue:
Error messages in an application can provide valid and invalid username information.
This information can potentially provide attackers with information for further attacks. This information allows attackers to perform brute-force attacks on the application.
Recommendation from pentester:
It is recommended to provide the same information in the error message so that it does not display whether the username is valid or not.
Please refer to attached excel for details.