The login mechanism of Sage DPW 2025_06_004 displays distinct responses for valid and invalid usernames, allowing enumeration of existing accounts in versions before 2021_06_000. On-premise administrators can toggle this behaviour in newer versions.
| Vendor | Product | Versions |
|---|---|---|
| n/a | n/a | n/a, 2025_06_004 |
Updated vendor to Sage, product to DPW, added affected version 2025_06_004, changed severity to HIGH, set CVSS estimate to 7.5, and marked as actively exploited.
Initial creation
