CVE-2017-16629

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

In SapphireIMS 4097_1, it is possible to guess the registered/active usernames of the software from the errors it gives out for each type of user on the Login form. For "Incorrect User" - it gives an error "The application failed to identify the user. Please contact administrator for help." For "Correct User and Incorrect Password" - it gives an error "Authentication failed. Please login again."

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-209

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://vuln.shellcoder.party/2020/07/18/cve-2017-16629-sapphireims-login-page-information-disclosure/Third Party Advisory
https://vuln.shellcoder.party/tags/sapphireims/Third Party Advisory
https://vuln.shellcoder.party/2020/07/18/cve-2017-16629-sapphireims-login-page-information-disclosure/Third Party Advisory
https://vuln.shellcoder.party/tags/sapphireims/Third Party Advisory

Timeline

Published: Aug 11, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-166308.8In SapphireIMS 4097_1, a guest user can create a local administrator account on any system that has SapphireIMS installed, because of an Ins CVE-2017-166316.5In SapphireIMS 4097_1, a guest user is able to change the password of an administrative user by utilizing an Insecure Direct Object Referenc CVE-2017-166327.5In SapphireIMS 4097_1, the password in the database is stored in Base64 format.CVE-2017-166334.3In Joomla! before 3.8.2, a logic bug in com_fields exposed read-only information about a site's custom fields to unauthorized users.CVE-2017-166349.8In Joomla! before 3.8.2, a bug allowed third parties to bypass a user's 2-factor authentication method.CVE-2017-166355.4In TinyWebGallery v2.4, an XSS vulnerability is located in the `mkname`, `mkitem`, and `item` parameters of the `Add/Create` module. Remote CVE-2017-166365.4In Bludit v1.5.2 and v2.0.1, an XSS vulnerability is located in the new page, new category, and edit post function body message context. Rem CVE-2017-166374.4In Vectura Perfect Privacy VPN Manager v1.10.10 and v1.10.11, when resetting the network data via the software client, with a running VPN co CVE-2017-166389.8The Gentoo net-misc/vde package before version 2.3.2-r4 may allow members of the "qemu" group to gain root privileges by creating a hard lin CVE-2017-166394.3Tor Browser on Windows before 8.0 allows remote attackers to bypass the intended anonymity feature and discover a client IP address, a diffe CVE-2017-16645.9IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 uses weaker than expected cryptographic algorithms that could allow an attacker to decryp CVE-2017-166417.2lib/rrd.php in Cacti 1.1.27 allows remote authenticated administrators to execute arbitrary OS commands via the path_rrdtool parameter in an