CVEvulnerability

CVE-2013-6020

5.8 MEDIUM Published 2013-10-28 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2013-10-28
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
5.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:N
Weaknesses
CWE-200

Description

passwordRequestPOST.jsp in Tyler Technologies TaxWeb 3.13.3.1 sends different HTTP status codes for invalid password-recovery requests depending on whether the user account exists, which allows remote attackers to enumerate account names via a series of requests to the (1) Assessor, (2) Recorder, or (3) Treasurer application.

Affected configurations

• tylertech taxweb 3.13.3.1

Related

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References