Vulnerability Report

CVE-2017-8055

Title: Watchguard Fireware Information Disclosure

Information Disclosure

Proof Of Concept

No public PoC currently indexed for CVE-2017-8055.

CWE Category CWE-203

Published Date Apr 22, 2017

Modified Date Jun 17, 2026

Exploit Status Not Found

Score 5.3 CVSS v3.0

Exploit Probability (EPSS)

1.59%

Vulnerability Summary

CVE-2017-8055: WatchGuard Fireware allows user enumeration, e.g., in the Firebox XML-RPC login handler. A login request that contains a blank password sent to the XML-RPC agent in Fireware v11.12.1 and earlier returns different responses for valid and invalid usernames. An attacker could exploit this vulnerability to enumerate valid usernames on an affected Firebox.

Impacted Vendors

watchguard 1

Reference Links

http://watchguardsupport.force.com/publicKB?type=KBSecurityIssues&SFDCID=kA62A0000000KlGSAU https://packetstormsecurity.com/files/142177/watchguardfbxtm-xxeinject.txt https://www.sidertia.com/Home/Community/Blog/2017/04/17/Fixed-the-Fireware-Vulnerabilities-discovered-by-Sidertia https://www.watchguard.com/support/release-notes/fireware/11/en-US/EN_ReleaseNotes_Fireware_11_12_2/index.html http://watchguardsupport.force.com/publicKB?type=KBSecurityIssues&SFDCID=kA62A0000000KlGSAU https://packetstormsecurity.com/files/142177/watchguardfbxtm-xxeinject.txt https://www.sidertia.com/Home/Community/Blog/2017/04/17/Fixed-the-Fireware-Vulnerabilities-discovered-by-Sidertia https://www.watchguard.com/support/release-notes/fireware/11/en-US/EN_ReleaseNotes_Fireware_11_12_2/index.html

CVSS v3.0

Source Entity [email protected]

Severity MEDIUM

5.3

Attack Vector

NETWORK

Complexity

LOW

Privileges

N/A

Interaction

NONE

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

UNCHANGED

RAW VECTOR CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CVSS v2.0

Source Entity [email protected]

Severity MEDIUM

5.0

Access Vector

N/A

Authentication

N/A

RAW VECTOR AV:N/AC:L/Au:N/C:P/I:N/A:N

Associated Attack Patterns (CAPEC)

Total: Patterns