CVE-2009-0348

CVE-2009-0348 describes a username enumeration vulnerability in Sun Java System Access Manager versions 6 2005Q1, 7 2005Q4, and 7.1. The login module exhibits different responses for existing versus non-existent user accounts, allowing remote attackers to identify valid usernames. This vulnerability has a CVSS score of 5.0, indicating a medium severity, with a network attack vector, low attack complexity, and a potential impact of partial confidentiality loss. While not listed in CISA KEV, an exploit for username enumeration is available on ExploitDB, though there is no evidence of active exploitation, Metasploit modules, or significant community discussion.