CVE-2003-0190 — MEDIUM severity vulnerability (OpenSSH-portable (OpenSSH) 3.6.1p1 and earlier with PAM supp)
OpenSSH-portable (OpenSSH) 3.6.1p1 and earlier with PAM support enabled immediately sends an error message when a user does not exist, which allows remote attackers to determine valid usernames via a timing attack.
| CVE ID | CVE-2003-0190 |
|---|---|
| Severity | MEDIUM |
| CVSS score | 5.0 |
| CVSS vector | AV:N/AC:L/Au:N/C:P/I:N/A:N |
| CWE | CWE-203 |
| Status | Modified |
| Published | 2003-05-12 |
| Last modified | 2026-04-16 |
| Description | OpenSSH-portable (OpenSSH) 3.6.1p1 and earlier with PAM support enabled immediately sends an error message when a user does not exist, which allows remote attackers to determine valid usernames via a timing attack. |
| Source | NIST National Vulnerability Database |
🔍 Search all vulnerabilities →
$999/mo
Try CVECheck →