Improper Restriction of Excessive Authentication Attempts
CWE-307
The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.
We track 293 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.5.
How this weakness is prevented
- Architecture and Design: Common protection mechanisms include: Disconnecting the user after a small number of failed attempts Implementing a timeout Locking out a targeted account Requiring a computational task on the user's part.
- Architecture and Design: Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. Consider using libraries with authentication capabilities such as OpenSSL or the ESAPI Authenticator.
Latest Improper Restriction of Excessive Authentication Attempts vulnerabilities
- 9.8 Critical severity
PowerStore: Improper Restriction of Excessive Authentication Attempts
Dell EMC PowerStore, contain(s) an Improper Restriction of Excessive Authentication Attempts Vulnerability in PowerStore Manager GUI. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to password brute-forcing. Account tak
- 7.5 High severity
Security Verify Governance: Improper Restriction of Excessive Authentication Attempts
IBM Security Verify Identity Manager 10.0 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 224918.
- 9.8 Critical severity
heroiclabs/nakama: Improper Restriction of Excessive Authentication Attempts
Improper Restriction of Excessive Authentication Attempts in GitHub repository heroiclabs/nakama prior to 3.13.0. This results in login brute-force attacks.
- 9.8 Critical severity
Spectrum Protect Server: Improper Restriction of Excessive Authentication Attempts
An IBM Spectrum Protect storage agent could allow a remote attacker to perform a brute force attack by allowing unlimited attempts to login to the storage agent without locking the administrative ID. A remote attacker could exploit this vulnerability using bru
- 9.8 Critical severity
Spectrum Protect Server: Improper Restriction of Excessive Authentication Attempts
In some cases, an unsuccessful attempt to log into IBM Spectrum Protect Operations Center 8.1.0.000 through 8.1.14.000 does not cause the administrator's invalid sign-on count to be incremented on the IBM Spectrum Protect Server. An attacker could exploit this
- 9.8 Critical severity
Topidp3000 Topsec Operating System: Improper Restriction of Excessive Authentication Attempts
An issue in TopIDP3000 Topsec Operating System tos_3.3.005.665b.15_smpidp allows attackers to perform a brute-force attack via a crafted session_id cookie.
- 9.8 Critical severity
Wiser Smart: Improper Restriction of Excessive Authentication Attempts
A CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could allow unauthorized access when an attacker uses brute force. Affected Products: Wiser Smart, EER21000 & EER21001 (V4.5 and prior)
- 9.8 Critical severity
Unity: Improper Restriction of Excessive Authentication Attempts
Dell Unity, Dell UnityVSA, and Dell Unity XT versions before 5.2.0.0.5.173 do not restrict excessive authentication attempts in Unisphere GUI. A remote unauthenticated attacker may potentially exploit this vulnerability to brute-force passwords and gain access
- 7.5 High severity
Desigo DXR2: Improper Restriction of Excessive Authentication Attempts
A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22), Desigo PXC3 (All versions < V01.21.142.4-18), Desigo PXC4 (All versions < V02.20.142.10-10884), Desigo PXC5 (All versions < V02.20.142.10-10884). The login functionality of th
- 9.8 Critical severity
PowerScale OneFS: Improper Restriction of Excessive Authentication Attempts
Dell PowerScale OneFS, versions 8.2.x-9.3.0.x, contain an improper restriction of excessive authentication attempts. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to compromised accounts.
- 9.8 Critical severity
Mendix Forgot Password Appstore module: Improper Restriction of Excessive Authentication Attempts
A vulnerability has been identified in Mendix Forgot Password Appstore module (All versions >= V3.3.0 < V3.5.1), Mendix Forgot Password Appstore module (Mendix 7 compatible) (All versions < V3.2.2). Initial passwords are generated in an insecure manner. This c
- 9.8 Critical severity
spaceLYnk (V2.6.2 and prior), Wiser for KNX…: Improper Restriction of Excessive Authentication Attempts
A CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could allow an attacker to manipulate the admin after numerous attempts at guessing credentials. Affected Product: spaceLYnk (V2.6.2 and prior), Wiser for KNX (forme
- 9.8 Critical severity
AppSync: Improper Restriction of Excessive Authentication Attempts
Dell EMC AppSync versions 3.9 to 4.3 contain an Improper Restriction of Excessive Authentication Attempts Vulnerability that can be exploited from UI and CLI. An adjacent unauthenticated attacker could potentially exploit this vulnerability, leading to passwor