CVE-2014-3105

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2014-09-23 · updated 2026-06-17
Weakness: CWE-200

Description

The OSLC integration feature in the Web component in IBM Rational ClearQuest 7.1 before 7.1.2.15, 8.0.0 before 8.0.0.12, and 8.0.1 before 8.0.1.5 provides different error messages for failed login attempts depending on whether the username exists, which allows remote attackers to enumerate account names via a series of requests.

Affected products

IBM Rational ClearCase: 7.1, 7.1.0.1, 7.1.0.2, 7.1.1, 7.1.1.1, 7.1.1.2 (+38)

References

http://www-01.ibm.com/support/docview.wss?uid=swg21682949
https://exchange.xforce.ibmcloud.com/vulnerabilities/94312
http://www-01.ibm.com/support/docview.wss?uid=swg21682949
https://exchange.xforce.ibmcloud.com/vulnerabilities/94312

Get alerted when CVE-2014-3105 or the next vulnerability affects your stack