Overly Restrictive Account Lockout Mechanism
CWE-645
The product contains an account lockout protection mechanism, but the mechanism is too restrictive and can be triggered too easily, which allows attackers to deny service to legitimate users by causing their accounts to be locked out.
We track 3 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 7.5. 1 has been exploited in real attacks.
How this weakness is prevented
- Architecture and Design: Implement more intelligent password throttling mechanisms such as those that take IP address into account, in addition to the login name.
- Architecture and Design: Implement a lockout timeout that grows as the number of incorrect login attempts goes up, eventually resulting in a complete lockout.
- Architecture and Design: Consider alternatives to account lockout that would still be effective against password brute force attacks, such as presenting the user machine with a puzzle to solve (making it do some computation).
Latest Overly Restrictive Account Lockout Mechanism vulnerabilities
- 7.5 High severity
payload: Improper Restriction of Excessive Authentication Attempts
Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an unauthenticated attacker who knows an account email address or username can abuse the account lockout mechanism of a
- 7.5 High severity
PowerScale OneFS: Overly Restrictive Account Lockout Mechanism
Dell PowerScale OneFS, version 9.13.0.0, contains an overly restrictive account lockout mechanism vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to denial of service.
- 7.5 High severity
KNX Association KNX Protocol Connection Authorization Option 1 Overly Restrictive Account Lockout Mechanism Exploited
KNX devices that use KNX Connection Authorization and support Option 1 are, depending on the implementation, vulnerable to being locked and users being unable to reset them to gain access to the device. The BCU key feature on the devices can be used to create