Improper Restriction of Excessive Authentication Attempts
CWE-307
The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.
We track 293 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.5.
How this weakness is prevented
- Architecture and Design: Common protection mechanisms include: Disconnecting the user after a small number of failed attempts Implementing a timeout Locking out a targeted account Requiring a computational task on the user's part.
- Architecture and Design: Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. Consider using libraries with authentication capabilities such as OpenSSL or the ESAPI Authenticator.
Latest Improper Restriction of Excessive Authentication Attempts vulnerabilities
- 7.5 High severity
ColdFusion: Improper Restriction of Excessive Authentication Attempts
Adobe ColdFusion versions 2018u16 (and earlier), 2021u6 (and earlier) and 2023.0.0.330468 (and earlier) are affected by an Improper Restriction of Excessive Authentication Attempts vulnerability that could result in a Security feature bypass. An attacker could
- 7.5 High severity
SAP BusinessObjects Business Intelligence…: Improper Restriction of Excessive Authentication Attempts
SAP BusinessObjects Business Intelligence Platform - version 420, 430, allows an unauthorized attacker who had hijacked a user session, to be able to bypass the victim’s old password via brute force, due to unrestricted rate limit for password change functiona
- 9.1 Critical severity
Online Shopping Portal: Improper Restriction of Excessive Authentication Attempts
A vulnerability was found in PHPGurukul Online Shopping Portal 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component Registration Page. The manipulation leads to improper restriction of excessive aut
- 9.1 Critical severity
security-advisories: Improper Restriction of Excessive Authentication Attempts
NextCloud Server and NextCloud Enterprise Server provide file storage for Nextcloud, a self-hosted productivity platform. In NextCloud Server versions 25.0.0 until 25.0.7 and 26.0.0 until 26.0.2 and Nextcloud Enterprise Server versions 21.0.0 until 21.0.9.12,
- 7.5 High severity
security-advisories: Improper Restriction of Excessive Authentication Attempts
Nextcloud Server is a data storage system for Nextcloud, a self-hosted productivity platform. When multiple requests are sent in parallel, all of them were executed even if the amount of faulty requests succeeded the limit by the time the response was sent to
- 7.5 High severity
Security Directory Suite VA: Improper Restriction of Excessive Authentication Attempts
IBM Security Directory Suite VA 8.0.1 through 8.0.1.19 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 228510.
- 8.8 High severity
FortiSIEM: Improper Restriction of Excessive Authentication Attempts
An Improper Restriction of Excessive Authentication Attempts [CWE-307] in FortiSIEM below 7.0.0 may allow a non-privileged user with access to several endpoints to brute force attack these endpoints.
- 9.8 Critical severity
security-advisories: Improper Restriction of Excessive Authentication Attempts
user_oidc app is an OpenID Connect user backend for Nextcloud. Authentication can be broken/bypassed in user_oidc app. It is recommended that the Nextcloud user_oidc app is upgraded to 1.3.2
- 7.5 High severity
security-advisories: Improper Restriction of Excessive Authentication Attempts
Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. In Nextcloud Server 24.0.0 prior to 24.0.11 and 25.0.0 prior to 25.0.5; as well as Nextcloud Server Enterprise 23.0.0 prior to 23.0.12.6, 24.0.0 prior to 24.0.11,
- 7.5 High severity
NetBotz 4 - 355/450/455/550/570: Improper Restriction of Excessive Authentication Attempts
A CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could cause account takeover when a brute force attack is performed on the account. Affected Products: NetBotz 4 - 355/450/455/550/570 (V4.7.0 and prior)
- 7.5 High severity
Adserver: Improper Restriction of Excessive Authentication Attempts
The login page of Revive Adserver v5.4.1 is vulnerable to brute force attacks. NOTE: The vendor's position is that this is effectively mitigated by rate limits and password-quality features.
- 9.8 Critical severity
Dr750-2ch Lte Firmware: Improper Restriction of Excessive Authentication Attempts
BlackVue DR750-2CH LTE v.1.012_2022.10.26 was discovered to contain a weak default passphrase which can be easily cracked via a brute force attack if the WPA2 handshake is intercepted.
- 8.8 High severity
FortiOS: Improper Restriction of Excessive Authentication Attempts
An improper restriction of excessive authentication attempts vulnerability [CWE-307] in Fortinet FortiOS version 7.2.0 through 7.2.3 and before 7.0.10, FortiProxy version 7.2.0 through 7.2.2 and before 7.0.8 administrative interface allows an attacker with a v
- 7.5 High severity
Flask-AppBuilder: Improper Restriction of Excessive Authentication Attempts
Flask-AppBuilder versions before 4.3.0 lack rate limiting which can allow an attacker to brute-force user credentials. Version 4.3.0 includes the ability to enable rate limiting using `AUTH_RATE_LIMITED = True`, `RATELIMIT_ENABLED = True`, and setting an `AUTH
- 7.1 High severity
security-advisories: Improper Restriction of Excessive Authentication Attempts
Nextcloud server is an open source, personal cloud implementation. In affected versions a malicious user could try to reset the password of another user and then brute force the 62^21 combinations for the password reset token. As of commit `704eb3aa` password
- 9.8 Critical severity
Pfsense Plus: Improper Restriction of Excessive Authentication Attempts
Improper restriction of excessive authentication attempts in the SSHGuard component of Netgate pfSense Plus software v22.05.1 and pfSense CE software v2.6.0 allows attackers to bypass brute force protection mechanisms via crafted web requests.
- 7.8 High severity
security-advisories: Improper Restriction of Excessive Authentication Attempts
Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform, and Nextcloud Enterprise Server is the enterprise version of the file server software. In Nextcloud Server versions 25.0.x prior to 25.0.5 and versions 24.0.x prio
- 7.5 High severity
xwiki-platform: Improper Restriction of Excessive Authentication Attempts
XWiki Platform is a generic wiki platform. Starting in version 3.2-m3, users can deduce the content of the password fields by repeated call to `LiveTableResults` and `WikisLiveTableResultsMacros`. The issue can be fixed by upgrading to versions 14.7-rc-1, 13.4
- 9.8 Critical severity
Myq: Improper Restriction of Excessive Authentication Attempts
A lack of rate limiting on the password reset endpoint of Chamberlain myQ v5.222.0.32277 (on iOS) allows attackers to compromise user accounts via a bruteforce attack.
- 9.8 Critical severity
kiwi: Improper Restriction of Excessive Authentication Attempts
Kiwi TCMS, an open source test management system, does not impose rate limits in versions prior to 12.0. This makes it easier to attempt brute-force attacks against the login page. Users should upgrade to v12.0 or later to receive a patch. As a workaround, use
- 9.8 Critical severity
YugabyteDB Anywhere: Improper Restriction of Excessive Authentication Attempts
Server-Side Request Forgery (SSRF), Improperly Controlled Modification of Dynamically-Determined Object Attributes, Improper Restriction of Excessive Authentication Attempts vulnerability in YugaByte, Inc. Yugabyte Managed allows Accessing Functionality Not Pr
- 9.8 Critical severity
Conext™ ComBox: Improper Restriction of Excessive Authentication Attempts
A CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could cause brute force attacks to take over the admin account when the product does not implement a rate limit mechanism on the admin authentication form. Affected
- 7.5 High severity
Service Manager: Improper Restriction of Excessive Authentication Attempts
An issue was discovered in EasyVista 2020.2.125.3 and 2022.1.109.0.03. Part of the application does not implement protection against brute-force attacks. Version 2022.1.133.0 corrects this issue.
- 7.5 High severity
Remote Desktop Manager: Improper Restriction of Excessive Authentication Attempts
Weak password derivation for export in Devolutions Remote Desktop Manager before 2022.1 allows information disclosure via a password brute-force attack. An error caused base64 to be decoded.
- 8.8 High severity
Planet Estream: Improper Restriction of Excessive Authentication Attempts
Planet eStream before 6.72.10.07 allows a low-privileged user to gain access to administrative and high-privileged user accounts by changing the value of the ON cookie. A brute-force attack can calculate a value that provides permanent access.
- 7.5 High severity
FortiSandbox: Improper Restriction of Excessive Authentication Attempts
An insufficient logging [CWE-778] vulnerability in FortiSandbox versions 4.0.0 to 4.0.2, 3.2.0 to 3.2.3 and 3.1.0 to 3.1.5 and FortiDeceptor versions 4.2.0, 4.1.0 through 4.1.1, 4.0.0 through 4.0.2, 3.3.0 through 3.3.3, 3.2.0 through 3.2.2,3.1.0 through 3.1.1
- 7.5 High severity
Gateway & Management, IPsec VPN blade SNX…: Improper Restriction of Excessive Authentication Attempts
The IPsec VPN blade has a dedicated portal for downloading and connecting through SSL Network Extender (SNX). If the portal is configured for username/password authentication, it is vulnerable to a brute-force attack on usernames and passwords.
- 7.5 High severity
Maarch Rm: Improper Restriction of Excessive Authentication Attempts
Maarch RM 2.8.3 solution contains an improper restriction of excessive authentication attempts due to excessive verbose responses from the application. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to compromised acco
- 7.5 High severity
CMS: Improper Restriction of Excessive Authentication Attempts
A vulnerability, which was classified as problematic, has been found in WBCE CMS. Affected by this issue is the function increase_attempts of the file wbce/framework/class.login.php of the component Header Handler. The manipulation of the argument X-Forwarded-
- 9.8 Critical severity
chatwoot/chatwoot: Improper Restriction of Excessive Authentication Attempts
Impact varies for each individual vulnerability in the application. For generation of accounts, it may be possible, depending on the amount of system resources available, to create a DoS event in the server. These accounts still need to be activated; however,
- 9.8 Critical severity
Fortinet FortiTester: Improper Restriction of Excessive Authentication Attempts
An improper restriction of excessive authentication attempts vulnerability [CWE-307] in FortiTester Telnet port 2.3.0 through 3.9.1, 4.0.0 through 4.2.0, 7.0.0 through 7.1.0 may allow an unauthenticated attacker to guess the credentials of an admin user via a
- 7.5 High severity
GitLab: Improper Restriction of Excessive Authentication Attempts
An issue has been discovered in GitLab CE/EE affecting all versions before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3 before 15.3.2. It may be possible for an attacker to guess a user's password by brute force by sen
- 9.8 Critical severity
XtremIO: Improper Restriction of Excessive Authentication Attempts
Dell EMC XtremIO versions prior to X2 6.4.0-22 contain a bruteforce vulnerability. A remote unauthenticated attacker can potentially exploit this vulnerability and gain access to an admin account.
- 9.8 Critical severity
U250 Firmware: Improper Restriction of Excessive Authentication Attempts
WiJungle NGFW Version U250 was discovered to be vulnerable to No Rate Limit attack, allowing the attacker to brute force the admin password leading to Account Take Over.
- 7.5 High severity
Plextrac: Improper Restriction of Excessive Authentication Attempts
The PlexTrac platform prior to version 1.17.0 does not restrict excessive authentication attempts for accounts configured to use the PlexTrac authentication provider. An unauthenticated remote attacker could perform a bruteforce attack on the login page with n
- 8.8 High severity
Plextrac: Improper Restriction of Excessive Authentication Attempts
The PlexTrac platform prior to API version 1.17.0 does not restrict excessive MFA TOTP submission attempts. An unauthenticated remote attacker in possession of a valid username and password can bruteforce their way past MFA protections to login as the targeted
- 7.5 High severity
octoprint/octoprint: Improper Restriction of Excessive Authentication Attempts
An attacker can freely brute force username and password and can takeover any account. An attacker could easily guess user passwords and gain access to user and administrative accounts.
- 9.8 Critical severity
Red Hat Process Automation Manager 7: Improper Restriction of Excessive Authentication Attempts
A flaw was found in Red Hat Process Automation Manager 7 where an attacker can benefit from a brute force attack against Administration Console as the application does not limit the number of unsuccessful login attempts.
- 9.8 Critical severity
Zammad: Improper Restriction of Excessive Authentication Attempts
Zammad 5.2.0 is vulnerable to privilege escalation. Zammad has a prevention against brute-force attacks trying to guess login credentials. After a configurable amount of attempts, users are invalidated and logins prevented. An attacker might work around this p
- 9.8 Critical severity
bookwyrm: Improper Restriction of Excessive Authentication Attempts
BookWyrm is a social network for tracking reading. Versions prior to 0.4.5 were found to lack rate limiting on authentication views which allows brute-force attacks. This issue has been patched in version 0.4.5. Admins with existing instances will need to upda