CVSS 3.1
5.3 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NCVE-2018-15473
OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed, related to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c.
Severity
- EPSS
- 99% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
- CWE
- CWE-362
- Published
- Modified
- Record from
- the NVD, synced
Affected
- canonical:ubuntu_linux
- debian:debian_linux
- netapp:aff_baseboard_management_controller
- netapp:cloud_backup
- netapp:clustered_data_ontap
- netapp:cn1610_firmware
- netapp:data_ontap
- netapp:data_ontap_edge
- netapp:fas_baseboard_management_controller
- netapp:oncommand_unified_manager
- netapp:ontap_select_deploy
- netapp:service_processor
- netapp:steelstore_cloud_integrated_storage
- netapp:storage_replication_adapter
- netapp:vasa_provider
- netapp:virtual_storage_console
- openbsd:openssh
- oracle:sun_zfs_storage_appliance_kit
- redhat:enterprise_linux_desktop
- redhat:enterprise_linux_server
- redhat:enterprise_linux_workstation
- siemens:scalance_x204rna_firmware