Weakness (CWE)
CWE-307: Improper Restriction of Excessive Authentication Attempts
The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.
How to prevent it (2 mitigations)
-
Architecture and Design
Common protection mechanisms include:
- Disconnecting the user after a small number of failed attempts
- Implementing a timeout
- Locking out a targeted account
- Requiring a computational task on the user's part.
-
Architecture and Design
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482].
Consider using libraries with authentication capabilities such as OpenSSL or the ESAPI Authenticator. [REF-45]
Source: MITRE CWE-307
215 results · Clear filters · Feed
-
Medium 6.5
Aiphone GT-DMB-N 3-in-1 Video Entrance Station with NFC Reader 1.0.3 does not mitigate against repeated failed access a…
-
Medium 4.8
User enumeration in the code-based login and password reset forms
Kirby is a flat-file CMS. In versions prior to 3.5.8.2, 3.6.6.2, 3.7.5.1, and 3.8.1, Kirby is subject to user enumeration due to Improper Restriction of Excessive Authentication Attempts. This vulnerability affects you only if you are using the `code` or `pas…
-
Medium 6.5
There is a password verification vulnerability in WS7200-10 11.0.2.13. Attackers on the LAN may use brute force crackin…
-
Medium 6.5
A flaw was found in Red Hat Process Automation Manager 7 where an attacker can benefit from a brute force attack agains…
-
Medium 5.5
Interlogix Hills ComNav Improper Restriction of Excessive Authentication Attempts
There is no limit to the number of attempts to authenticate for the local configuration pages for the Hills ComNav Version 3002-19 interface, which allows local attackers to brute-force credentials.
-
Medium 4.2
A vulnerable design in fingerprint matching algorithm prior to SMR Mar-2022 Release 1 allows physical attackers to perf…
-
Medium 5.9
Bypass bruteforce protection on login form in elabftw
eLabFTW is an open source electronic lab notebook manager for research teams. In versions of eLabFTW before 4.1.0, it allows attackers to bypass a brute-force protection mechanism by using many different forged PHPSESSID values in HTTP Cookie header. This iss…
-
Medium 6.3
InHand Networks IR615 Router
InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 have has no account lockout policy configured for the login page of the product. This may allow an attacker to execute a brute-force password attack with no time limitation and without harmin…
-
Medium 5.7
Dell BIOS contains an Improper Restriction of Excessive Authentication Attempts vulnerability. A local authenticated ma…
-
Medium 5.7
Dell BIOS contains an Improper Restriction of Excessive Authentication Attempts vulnerability. A local authenticated ma…
-
Medium 5.3
Improper Restriction of Excessive Authentication Attempts in firefly-iii/firefly-iii
firefly-iii is vulnerable to Improper Restriction of Excessive Authentication Attempts
-
Medium 5.4
Cisco Webex Meetings and Cisco Webex Meetings Server Host Key Brute Forcing Vulnerability
A vulnerability in the reclaim host role feature of Cisco Webex Meetings and Cisco Webex Meetings Server could allow an authenticated, remote attacker to take over the host role during a meeting. This vulnerability is due to a lack of protection against brute…
-
Medium 5.3
JATP Series: JATP Is susceptible to slow brute force attacks on the SSH service.
Due to insufficient server-side login attempt limit enforcement, a vulnerability in the SSH login service of Juniper Networks Juniper Advanced Threat Prevention (JATP) Series and Virtual JATP (vJATP) devices allows an unauthenticated, remote attacker to perfo…
-
Medium 5.3
Junos OS: Login credentials are vulnerable to brute force attacks through the REST API
If REST API is enabled, the Junos OS login credentials are vulnerable to brute force attacks. The high default connection limit of the REST API may allow an attacker to brute-force passwords using advanced scripting techniques. Additionally, administrators wh…
-
Medium 5.4
Keycloak Improper Bruteforce Detection
A flaw was found in Keycloak 4.2.1.Final, 4.3.0.Final. When TOPT enabled, an improper implementation of the Brute Force detection algorithm will not enforce its protection measures.