Weaknesses of type CWE-307

484 results

Falta de Proteção contra Tentativas Excessivas de Autenticação

É a ausência de mecanismos que limitam o número de tentativas de login ou autenticação em um curto período. Um atacante pode fazer força bruta (testar muitas senhas ou códigos) sem ser bloqueado, permitindo descobrir credenciais válidas ou contornar fatores de autenticação como OTP.

Example

Um sistema de login não bloqueia a conta após 5 tentativas erradas nem implementa delay progressivo. Um atacante automático testa 10 mil combinações de senha em minutos contra um usuário-alvo e consegue acesso. Ou um atacante bruta-força códigos de 2FA sem que o sistema limite as tentativas.

How to mitigate

Implemente bloqueio ou throttling: limitar tentativas (ex: máx 5 por minuto), aumentar delay entre tentativas, bloquear conta temporariamente após falhas consecutivas, usar CAPTCHA após N tentativas, e registrar/alertar sobre picos de tentativas suspeitas.

CVE-2021-41171MEDIUMBypass bruteforce protection on login form in elabftwEPSS 1.9%CVE-2017-15887—An improper restriction of excessive authentication attempts vulnerability in /principals in Synology CardDAV Server before 6.0.7-0085 allowEPSS 1.9%CVE-2020-25196CRITICALMOXA NPort IAW5000A-I/O SeriesEPSS 1.8%CVE-2023-26208LOWA improper restriction of excessive authentication attempts vulnerability [CWE-307] in Fortinet FortiAuthenticator 6.4.x and before allows EPSS 1.8%CVE-2022-29056LOWA improper restriction of excessive authentication attempts vulnerability [CWE-307] in Fortinet FortiMail version 6.4.0, version 6.2.0 throuEPSS 1.8%CVE-2023-27746CRITICALBlackVue DR750-2CH LTE v.1.012_2022.10.26 was discovered to contain a weak default passphrase which can be easily cracked via a brute force EPSS 1.8%CVE-2023-26209LOWA improper restriction of excessive authentication attempts vulnerability [CWE-307] in Fortinet FortiDeceptor 3.1.x and before allows a remEPSS 1.7%CVE-2021-22915—Nextcloud server before 19.0.11, 20.0.10, 21.0.2 is vulnerable to brute force attacks due to lack of inclusion of IPv6 subnets in rate-limitEPSS 1.7%CVE-2020-11052HIGHImproper Restriction of Excessive Authentication Attempts in SorceryEPSS 1.6%CVE-2024-5716HIGHLogsign Unified SecOps Platform Authentication Bypass VulnerabilityEPSS 1.6%CVE-2022-2321HIGHImproper Restriction of Excessive Authentication Attempts in heroiclabs/nakamaEPSS 1.6%CVE-2017-7915—An Improper Restriction of Excessive Authentication Attempts issue was discovered in Moxa OnCell G3110-HSPA Version 1.3 build 15082117 and pEPSS 1.5%CVE-2019-13918—A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V2.0 SP1). The web interface has no means to prevent pasEPSS 1.5%CVE-2020-15786CRITICALA vulnerability has been identified in SIMATIC HMI Basic Panels 2nd Generation (incl. SIPLUS variants) (All versions < V16), SIMATIC HMI ComEPSS 1.5%CVE-2022-26314—A vulnerability has been identified in Mendix Forgot Password Appstore module (All versions >= V3.3.0 < V3.5.1), Mendix Forgot Password AppsEPSS 1.5%CVE-2019-18235—Advantech Spectre RT ERT351 Versions 5.1.3 and prior has insufficient login authentication parameters required for the web application may aEPSS 1.5%CVE-2020-7525—Improper Restriction of Excessive Authentication Attempts vulnerability exists in all hardware versions of spaceLYnk and Wiser for KNX (formEPSS 1.5%CVE-2021-43958CRITICALVarious rest resources in Fisheye and Crucible before version 4.8.9 allowed remote attackers to brute force user login credentials as rest rEPSS 1.5%CVE-2020-7508—A CWE-307 Improper Restriction of Excessive Authentication Attempts vulnerability exists in Easergy T300 (Firmware version 1.5.2 and older) EPSS 1.4%CVE-2020-1616MEDIUMJATP Series: JATP Is susceptible to slow brute force attacks on the SSH service.EPSS 1.4%