Fallos del tipo CWE-307

484 resultados

Falta de limitação em tentativas de autenticação

É quando a aplicação não restringe adequadamente quantas vezes um atacante pode tentar adivinhar credenciais (senha, PIN, código MFA). Sem limite de tentativas ou delay entre elas, força bruta fica viável: o atacante testa combinações até encontrar a senha correta.

Ejemplo

Um formulário de login que aceita requisições ilimitadas sem rate limiting — alguém escreve um script que testa 10 mil senhas por segundo contra uma conta específica até acertar. Ou um endpoint de recuperação de senha que valida códigos sem contar quantas tentativas erradas já houve.

Cómo mitigar

Implemente rate limiting (máximo de tentativas por IP/usuário em janela de tempo), aumente delay exponencial entre tentativas falhadas, bloqueie a conta ou IP temporariamente após N falhas, e use CAPTCHA ou MFA para dificultar automação. Log de tentativas suspeitas é essencial para detecção.

CVE-2024-7292HIGHAccount Controller allows high count of login attemptsEPSS 0.3%CVE-2025-6015MEDIUMVault Login MFA Bypass of Rate Limiting and TOTP Code ReuseEPSS 0.3%CVE-2025-35041HIGHAirship AI Acropolis MFA insufficient rate limitingEPSS 0.3%CVE-2026-7820MEDIUMpgAdmin 4: Account-lockout bypass via Flask-Security default /login viewEPSS 0.3%CVE-2026-41037HIGHMissing Rate Limiting Vulnerability in Quantum Networks Router QN-I-470EPSS 0.3%CVE-2026-16619HIGHminiOrange 2FA < 6.2.8 - 2FA Bypass via Unlimited Second-Factor AttemptsEPSS 0.3%CVE-2024-38488MEDIUMDell RecoverPoint for Virtual Machines 6.0.x contains a vulnerability. An improper Restriction of Excessive Authentication vulnerability wheEPSS 0.3%CVE-2026-22616MEDIUMEaton Intelligent Power Protector (IPP) software allows repeated authentication attempts against the web interface login page due to insuffiEPSS 0.3%CVE-2024-51720MEDIUMVulnerabilities in SecuSUITE Server Components Impact SecuSUITEEPSS 0.3%CVE-2026-7255MEDIUM** UNSUPPORTED WHEN ASSIGNED ** An improper restriction of excessive authentication attempts vulnerability in the web management interface oEPSS 0.3%CVE-2026-47380MEDIUMNocoDB: User Enumeration via Sign-In TimingEPSS 0.3%CVE-2023-48318MEDIUMWordPress Contact Form Email plugin <= 1.3.41 - Captcha Bypass vulnerabilityEPSS 0.3%CVE-2026-13348MEDIUMCWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could allow an attacker to gain unauthorized acEPSS 0.3%CVE-2025-2911MEDIUMImproper Restriction of Excessive Authentication Attempts vulnerability in MeetMe productsEPSS 0.3%CVE-2026-11915MEDIUMBrute force attack protection - Critical - Unsupported - SA-CONTRIB-2026-047EPSS 0.3%CVE-2024-24721MEDIUMAn issue was discovered on Innovaphone PBX before 14r1 devices. The password form, used to authenticate, allows a Brute Force Attack throughEPSS 0.3%CVE-2024-47592MEDIUMInformation Disclosure Vulnerability in SAP NetWeaver Application Server Java (Logon Application)EPSS 0.3%CVE-2022-40903MEDIUMAiphone GT-DMB-N 3-in-1 Video Entrance Station with NFC Reader 1.0.3 does not mitigate against repeated failed access attempts, which allowsEPSS 0.3%CVE-2025-7882LOWMercusys MW301R Login excessive authenticationEPSS 0.3%CVE-2026-92583MEDIUMAVideo through 29.0 Rate Limit Bypass via Non-Atomic Counter IncrementEPSS 0.3%