Low severity3.7NVD Advisory· Published Feb 3, 2021· Updated Jun 17, 2026

CVE-2020-9389

Description

A username enumeration issue was discovered in SquaredUp before version 4.6.0. The login functionality was implemented in a way that would enable a malicious user to guess valid username due to a different response time from invalid usernames.

Affected products

SquaredUp/SquaredUp2 versions
cpe:2.3:a:squaredup:squaredup:*:*:*:*:system_center_operations_manager:*:*:*+ 1 more
- cpe:2.3:a:squaredup:squaredup:*:*:*:*:system_center_operations_manager:*:*:*range: <=4.6
- (no CPE)range: <4.6.0
SquaredUp/SquaredUpdescription

Patches

Vulnerability mechanics

References

support.squaredup.com/hc/en-us/articles/360017255858nvdBroken LinkVendor Advisory
support.squaredup.com/hc/en-us/articles/360019427238-CVE-2020-9389-Username-enumeration-possible-via-a-timing-attacknvdBroken LinkVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.240
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000