CVE-2013-6020 - CVE House
Back to Database
Status published Medium CVE-2013-6020

passwordRequestPOST.jsp in Tyler Technologies TaxWeb 3.13.3.1 sends different HTTP status...

Vulnerability Description

passwordRequestPOST.jsp in Tyler Technologies TaxWeb 3.13.3.1 sends different HTTP status codes for invalid password-recovery requests depending on whether the user account exists, which allows remote attackers to enumerate account names via a series of requests to the (1) Assessor, (2) Recorder, or (3) Treasurer application.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2013-6020

Credits & Attribution

No credits recorded in the NVD database.

References

More from tylertech

View All →
CVE-2022-26665
An Insecure Direct Object Reference issue exists in the Tyler...
High 7.5
CVE-2019-16112
TylerTech Eagle 2018.3.11 deserializes untrusted user input, resulting in remote...
High 8.8
CVE-2013-6285
The search component in the Treasurer application in Tyler Technologies...
Medium 5
CVE-2013-6019
Cross-site scripting (XSS) vulnerability in Tyler Technologies TaxWeb 3.13.3.1 allows...
Medium 4.3
CVE-2013-6018
Cross-site request forgery (CSRF) vulnerability in login.jsp in Tyler Technologies...
Medium 6.8

Affected Vendor

Affected Software

taxweb
Vulnerable Versions:
3.13.3.1

Timeline

Official Publish: October 28th, 2013
Last Modified: September 16th, 2024
Added to House: July 19th, 2026

CVSS Vectors

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.