Weaknesses of type CWE-307

484 results

Falta de Proteção contra Tentativas Excessivas de Autenticação

É a ausência de mecanismos que limitam o número de tentativas de login ou autenticação em um curto período. Um atacante pode fazer força bruta (testar muitas senhas ou códigos) sem ser bloqueado, permitindo descobrir credenciais válidas ou contornar fatores de autenticação como OTP.

Example

Um sistema de login não bloqueia a conta após 5 tentativas erradas nem implementa delay progressivo. Um atacante automático testa 10 mil combinações de senha em minutos contra um usuário-alvo e consegue acesso. Ou um atacante bruta-força códigos de 2FA sem que o sistema limite as tentativas.

How to mitigate

Implemente bloqueio ou throttling: limitar tentativas (ex: máx 5 por minuto), aumentar delay entre tentativas, bloquear conta temporariamente após falhas consecutivas, usar CAPTCHA após N tentativas, e registrar/alertar sobre picos de tentativas suspeitas.

CVE-2023-45148MEDIUMRate limiter not working reliable when Memcached is installed in NextcloudEPSS 0.7%CVE-2023-32319HIGHBasic auth header on WebDAV requests is not brute-force protected in NextcloudEPSS 0.7%CVE-2023-27172CRITICALXpand IT Write-back Manager v2.3.1 uses weak secret keys to sign JWT tokens. This allows attackers to easily obtain the secret key used to sEPSS 0.7%CVE-2022-2650HIGHImproper Restriction of Excessive Authentication Attempts in wger-project/wgerEPSS 0.7%CVE-2023-1101HIGHSonicOS SSLVPN improper restriction of excessive MFA attempts vulnerability allows an authenticated attacker to use excessive MFA codes.EPSS 0.7%CVE-2025-6029CRITICALKIA-branded Aftermarket Generic Smart Keyless Entry System Replay AttackEPSS 0.7%CVE-2022-40055CRITICALAn issue in GX Group GPON ONT Titanium 2122A T2122-V1.26EXL allows attackers to escalate privileges via a brute force attack at the login paEPSS 0.7%CVE-2023-3605MEDIUMPHPGurukul Online Shopping Portal Registration Page excessive authenticationEPSS 0.7%CVE-2023-38273HIGHIBM Cloud Pak System information disclosureEPSS 0.7%CVE-2024-12039HIGHImproper Restriction of Excessive Authentication Attempts in langgenius/difyEPSS 0.7%CVE-2025-60424HIGHA lack of rate limiting in the OTP verification component of Nagios Fusion v2024R1.2 and v2024R2 allows attackers to bypass authentication vEPSS 0.7%CVE-2023-40706HIGHImproper Restriction of Excessive Authentication Attempts in OPTO 22 SNAP PAC S1 Built-in Web ServerEPSS 0.7%CVE-2023-49810HIGHA login attempt restriction bypass vulnerability exists in the checkLoginAttempts functionality of WWBN AVideo dev master commit 15fed957fb.EPSS 0.7%CVE-2023-45191HIGHIBM Engineering Lifecycle Optimization information disclosureEPSS 0.7%CVE-2023-50326HIGHIBM PowerSC information DisclosureEPSS 0.7%CVE-2023-0860HIGHImproper Restriction of Excessive Authentication Attempts in modoboa/modoboa-installerEPSS 0.7%CVE-2023-33868MEDIUMPiiGAB M-Bus Improper Restriction of Excessive Authentication AttemptsEPSS 0.7%CVE-2023-33754MEDIUMThe captive portal in Inpiazza Cloud WiFi versions prior to v4.2.17 does not enforce limits on the number of attempts for password recovery,EPSS 0.7%CVE-2024-42466CRITICALLack of resources and rate limiting - loginEPSS 0.7%CVE-2023-24020HIGH Snap One Wattbox WB-300-IP-3 versions WB10.9a17 and prior could bypass the brute force protection, allowing multiple attempts to force a loEPSS 0.6%