CVE-2017-16629

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-08-11 · updated 2026-06-17
Weakness: CWE-209

Description

In SapphireIMS 4097_1, it is possible to guess the registered/active usernames of the software from the errors it gives out for each type of user on the Login form. For "Incorrect User" - it gives an error "The application failed to identify the user. Please contact administrator for help." For "Correct User and Incorrect Password" - it gives an error "Authentication failed. Please login again."

Affected products

Sapphireims: 4097_1

References

https://vuln.shellcoder.party/2020/07/18/cve-2017-16629-sapphireims-login-page-information-disclosure/
https://vuln.shellcoder.party/tags/sapphireims/
https://vuln.shellcoder.party/2020/07/18/cve-2017-16629-sapphireims-login-page-information-disclosure/
https://vuln.shellcoder.party/tags/sapphireims/

Get alerted when CVE-2017-16629 or the next vulnerability affects your stack