Security readout for executives and security teams
Plain-English summary
This issue lets someone distinguish valid local usernames from invalid ones through GDM authentication error messages when VerboseAuth is enabled. That can aid targeted password guessing or social engineering, but the bundle provides no severity score, affected version list, patch details, or active exploitation evidence.
Executive priority
Handle as a hardening and exposure-reduction item unless GDM is exposed to untrusted users. Business urgency rises where usernames are sensitive or where attackers can repeatedly interact with the login screen.
Technical view
CVE-1999-0990 describes user enumeration in gdm caused by VerboseAuth error-message behavior. The known condition is VerboseAuth being enabled. The provided data does not identify specific GDM versions, distributions, CWE mapping, CVSS, or a vendor-fixed release.
Likely exposure
Likely limited to systems using GDM where VerboseAuth is enabled. Exposure depends on whether the GDM login surface is reachable by untrusted users, such as shared workstations, kiosks, labs, or remote graphical login setups.
Exploitation context
The bundle does not indicate KEV listing or active exploitation. The weakness is information disclosure: differentiated authentication messages can reveal valid account names, which may support later attacks but is not described as direct account compromise.
Researcher notes
The public bundle is sparse. It supports the core issue and VerboseAuth condition, but not affected versions, fixed releases, CVSS, CWE, or exploit maturity. Avoid broad product claims without distribution-specific advisories.
Mitigation direction
- Review vendor or distribution guidance for GDM fixes and configuration recommendations.
- Disable unnecessary verbose authentication messaging if supported by your vendor.
- Limit untrusted access to graphical login surfaces on shared systems.
- Monitor authentication failures for enumeration-like patterns.
Validation and detection
- Inventory systems using GDM as the display manager.
- Check whether VerboseAuth is enabled in GDM configuration.
- Confirm login failure messages do not disclose account validity.
- Prioritize validation on shared, kiosk, lab, and remote graphical login systems.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-1999-0990 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://exchange.xforce.ibmcloud.com/vulnerabilities/CVE-1999-0990CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.