Weakness (CWE)
CWE-307: Improper Restriction of Excessive Authentication Attempts
The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.
How to prevent it (2 mitigations)
-
Architecture and Design
Common protection mechanisms include:
- Disconnecting the user after a small number of failed attempts
- Implementing a timeout
- Locking out a targeted account
- Requiring a computational task on the user's part.
-
Architecture and Design
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482].
Consider using libraries with authentication capabilities such as OpenSSL or the ESAPI Authenticator. [REF-45]
Source: MITRE CWE-307
572 results · Feed
-
High 7.8CVE-2023-0860 Public exploit
Improper Restriction of Excessive Authentication Attempts in modoboa/modoboa-installer
Improper Restriction of Excessive Authentication Attempts in GitHub repository modoboa/modoboa-installer prior to 2.0.4.
-
High 7.5
Kiwi TCMS has no protection against brute-force attacks on login page
Kiwi TCMS, an open source test management system, does not impose rate limits in versions prior to 12.0. This makes it easier to attempt brute-force attacks against the login page. Users should upgrade to v12.0 or later to receive a patch. As a workaround, us…
-
Low 3.7
Dell SupportAssist contains a rate limit bypass issues in screenmeet API third party component. An unauthenticated atta…
-
Medium 6.8
Server-Side Request Forgery
Server-Side Request Forgery (SSRF), Improperly Controlled Modification of Dynamically-Determined Object Attributes, Improper Restriction of Excessive Authentication Attempts vulnerability in YugaByte, Inc. Yugabyte Managed allows Accessing Functionality Not P…
-
High 7.5
Snap One Wattbox WB-300-IP-3 versions WB10.9a17 and prior could bypass the brute force protection, allowing multiple at…
-
High 8.6
A CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could cause brute force …
-
Medium 5.4
HCL BigFix Mobile / Modern Client Management Server passwords are susceptible to a brute-force attack
HCL BigFix Mobile / Modern Client Management Admin and Config UI passwords can be brute-forced. User should be locked out for multiple invalid attempts.
-
High 8.2
An issue was discovered in EasyVista 2020.2.125.3 and 2022.1.109.0.03. Part of the application does not implement prote…
-
Critical 9.8
Improper Restriction of Excessive Authentication Attempts in usememos/memos
Improper Restriction of Excessive Authentication Attempts in GitHub repository usememos/memos prior to 0.9.1.
-
High 7.4
Weak password derivation for export in Devolutions Remote Desktop Manager before 2022.1 allows information disclosure v…
-
High 8.8
Planet eStream before 6.72.10.07 allows a low-privileged user to gain access to administrative and high-privileged user…
-
High 7.5
The IPsec VPN blade has a dedicated portal for downloading and connecting through SSL Network Extender (SNX). If the po…
-
High 7.8CVE-2022-2650 Public exploit
Improper Restriction of Excessive Authentication Attempts in wger-project/wger
Improper Restriction of Excessive Authentication Attempts in GitHub repository wger-project/wger prior to 2.2.
-
High 7.5
Maarch RM 2.8.3 solution contains an improper restriction of excessive authentication attempts due to excessive verbose…
-
Critical 9.8
Improper Restriction of Excessive Authentication Attempts in mastodon/mastodon
Improper Restriction of Excessive Authentication Attempts in GitHub repository mastodon/mastodon prior to 4.0.0.
-
Critical 9.4
Improper Restriction of Excessive Authentication Attempts in kareadita/kavita
Improper Restriction of Excessive Authentication Attempts in GitHub repository kareadita/kavita prior to 0.6.0.3.
-
Medium 6.5
Aiphone GT-DMB-N 3-in-1 Video Entrance Station with NFC Reader 1.0.3 does not mitigate against repeated failed access a…
-
Critical 9.4
Improper Restriction of Excessive Authentication Attempts in kareadita/kavita
Improper Restriction of Excessive Authentication Attempts in GitHub repository kareadita/kavita prior to 0.6.0.3.
-
Critical 9.4
Improper Restriction of Excessive Authentication Attempts in chatwoot/chatwoot
Impact varies for each individual vulnerability in the application. For generation of accounts, it may be possible, depending on the amount of system resources available, to create a DoS event in the server. These accounts still need to be activated; however,…
-
Medium 4.8
User enumeration in the code-based login and password reset forms
Kirby is a flat-file CMS. In versions prior to 3.5.8.2, 3.6.6.2, 3.7.5.1, and 3.8.1, Kirby is subject to user enumeration due to Improper Restriction of Excessive Authentication Attempts. This vulnerability affects you only if you are using the `code` or `pas…
-
Low 3.7
An issue has been discovered in GitLab CE/EE affecting all versions before 15.1.6, all versions starting from 15.2 befo…
-
Critical 9.8
An issue in GX Group GPON ONT Titanium 2122A T2122-V1.26EXL allows attackers to escalate privileges via a brute force a…
-
High 8.1
Dell EMC XtremIO versions prior to X2 6.4.0-22 contain a bruteforce vulnerability. A remote unauthenticated attacker ca…
-
Critical 9.8
WiJungle NGFW Version U250 was discovered to be vulnerable to No Rate Limit attack, allowing the attacker to brute forc…
-
Medium 6.5
There is a password verification vulnerability in WS7200-10 11.0.2.13. Attackers on the LAN may use brute force crackin…
-
Low 3.7
Authentication Bypass by Primary Weakness in octoprint/octoprint
An attacker can freely brute force username and password and can takeover any account. An attacker could easily guess user passwords and gain access to user and administrative accounts.
-
Medium 6.5
A flaw was found in Red Hat Process Automation Manager 7 where an attacker can benefit from a brute force attack agains…
-
High 8.1
Dell EMC PowerStore, contain(s) an Improper Restriction of Excessive Authentication Attempts Vulnerability in PowerStor…
-
High 7.5
Improper Restriction of Excessive Authentication Attempts in heroiclabs/nakama
Improper Restriction of Excessive Authentication Attempts in GitHub repository heroiclabs/nakama prior to 3.13.0. This results in login brute-force attacks.
-
High 8.6
A CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could allow unauthorized…
-
High 8.1
Dell Unity, Dell UnityVSA, and Dell Unity XT versions before 5.2.0.0.5.173 do not restrict excessive authentication att…
-
Unscored —
A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22), Desigo PXC3 (All versions < V01.21…
-
Medium 5.5
Interlogix Hills ComNav Improper Restriction of Excessive Authentication Attempts
There is no limit to the number of attempts to authenticate for the local configuration pages for the Hills ComNav Version 3002-19 interface, which allows local attackers to brute-force credentials.
-
High 8.1
Dell PowerScale OneFS, versions 8.2.x-9.3.0.x, contain an improper restriction of excessive authentication attempts. An…
-
Critical 9.8
Various rest resources in Fisheye and Crucible before version 4.8.9 allowed remote attackers to brute force user login …
-
Medium 4.2
A vulnerable design in fingerprint matching algorithm prior to SMR Mar-2022 Release 1 allows physical attackers to perf…
-
Unscored —
A vulnerability has been identified in Mendix Forgot Password Appstore module (All versions >= V3.3.0 < V3.5.1), Mendix…
-
Unscored —
A CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could allow an attacker …
-
High 8.1
Dell EMC AppSync versions 3.9 to 4.3 contain an Improper Restriction of Excessive Authentication Attempts Vulnerability…
-
High 7.5
Lack of rate limiting in M-Files Server and M-Files Web products with versions before 21.12.10873.0, allows brute-forcing of certain type of user accounts.
Lack of rate limiting in M-Files Server and M-Files Web products with versions before 21.12.10873.0 in certain type of user accounts allows unlimited amount of attempts and therefore makes brute-forcing login accounts easier.