CVE-1999-1231: SSH SSH2

Medium severity, CVSS 5.0. EPSS: 1.5% chance of exploitation in the next 30 days.

ssh 2.0.12, and possibly other versions, allows valid user names to attempt to enter the correct password multiple times, but only prompts an invalid user name for a password once, which allows remote attackers to determine user account names on the server.

Affected products

• SSH SSH2: version 2.0 only; version 2.0.1 only; version 2.0.2 only; version 2.0.3 only; version 2.0.4 only; version 2.0.5 only; …

Published 1999-06-09. Last modified 2026-06-16.