Fallos del tipo CWE-307

484 resultados

Falta de limitação em tentativas de autenticação

É quando a aplicação não restringe adequadamente quantas vezes um atacante pode tentar adivinhar credenciais (senha, PIN, código MFA). Sem limite de tentativas ou delay entre elas, força bruta fica viável: o atacante testa combinações até encontrar a senha correta.

Ejemplo

Um formulário de login que aceita requisições ilimitadas sem rate limiting — alguém escreve um script que testa 10 mil senhas por segundo contra uma conta específica até acertar. Ou um endpoint de recuperação de senha que valida códigos sem contar quantas tentativas erradas já houve.

Cómo mitigar

Implemente rate limiting (máximo de tentativas por IP/usuário em janela de tempo), aumente delay exponencial entre tentativas falhadas, bloqueie a conta ou IP temporariamente após N falhas, e use CAPTCHA ou MFA para dificultar automação. Log de tentativas suspeitas é essencial para detecção.

CVE-2024-22425MEDIUMDell RecoverPoint for Virtual Machines 5.3.x, 6.0.SP1 contains a brute force/dictionary attack vulnerability. An unauthenticated remote attaEPSS 0.5%CVE-2024-32868MEDIUMZITADEL's Improper Lockout Mechanism Leads to MFA BypassEPSS 0.5%CVE-2025-64310CRITICALEPSON WebConfig and Epson Web Control for SEIKO EPSON Projector Products do not restrict excessive authentication attempts. An administrativEPSS 0.5%CVE-2025-42600HIGHBrute Force Attack Vulnerability in Meon KYC solutionsEPSS 0.5%CVE-2026-6947HIGHD-Link｜DWM-222W USB Wi-Fi Adapter - Brute-Force Protection BypassEPSS 0.5%CVE-2026-47203LOWAuthelia Missing Username Canonicalization in Basic Auth (LDAP)EPSS 0.5%CVE-2024-3102MEDIUMJSON Injection in mintplex-labs/anything-llmEPSS 0.5%CVE-2025-1740CRITICALAuthentication Bypass in Akinsoft's MyRezztaEPSS 0.5%CVE-2026-73056CRITICALSiYuan kernel before 3.7.4 Unthrottled Brute-Force via API TokenEPSS 0.4%CVE-2025-69615CRITICALIncorrect Access Control via missing 2FA rate-limiting allowing unlimited brute-force retries and full MFA bypass with no user interaction rEPSS 0.4%CVE-2026-3329HIGHNexus Repository Manager - Improper Restriction of Excessive Authentication AttemptsEPSS 0.4%CVE-2023-41270LOWSamsung Smart TV UE40D7000 WPS DoS attackEPSS 0.4%CVE-2024-39873HIGHA vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). The affected application does not properly imEPSS 0.4%CVE-2024-41682MEDIUMA vulnerability has been identified in Location Intelligence family (All versions < V4.4). Affected products do not properly enforce restricEPSS 0.4%CVE-2025-67853HIGHMoodle: moodle: brute-force facilitation due to missing rate limiting in confirmation email serviceEPSS 0.4%CVE-2023-32251LOWKernel: ksmbd brute force delay bypass via asynchronous requestsEPSS 0.4%CVE-2022-34389LOW Dell SupportAssist contains a rate limit bypass issues in screenmeet API third party component. An unauthenticated attacker could potentialEPSS 0.4%CVE-2026-6223CRITICALOTP Bypass in Bahçelievler Muncipality's BiHayat AppEPSS 0.4%CVE-2025-2417HIGHOTP Bypass in Akinsoft's e-MutabakatEPSS 0.4%CVE-2025-2411HIGHOTP Bypass in Akinsoft's TaskPanoEPSS 0.4%