Problem/Motivation

With security audits the auditor points out that username enummeration is possible caused by the message "Username or password is unknown".

Proposed resolution

Add and enable the module username_enumeration_prevention

CommentFileSizeAuthor
#3 dvg-update_drupal_3238487-3.patch358 bytesjoshahubbers

Comments

JoshaHubbers created an issue. See original summary.

joshahubbers’s picture

joshahubbers commented
Issue summary: View changes
joshahubbers’s picture

joshahubbers commented
StatusFileSize
new dvg-update_drupal_3238487-3.patch358 bytes

This issue is solved in the drupal 7.83 update. So let's update to the latest drupal version.

joshahubbers’s picture

joshahubbers commented
Status: Active » Needs review
joshahubbers’s picture

joshahubbers commented
Status: Needs review » Fixed

  • JoshaHubbers authored 8afc028 on 7.x-1.x 
    Issue #3238487 by JoshaHubbers: Add username_enumeration_prevention...

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.