Fallos del tipo CWE-307

484 resultados

Falta de limitação em tentativas de autenticação

É quando a aplicação não restringe adequadamente quantas vezes um atacante pode tentar adivinhar credenciais (senha, PIN, código MFA). Sem limite de tentativas ou delay entre elas, força bruta fica viável: o atacante testa combinações até encontrar a senha correta.

Ejemplo

Um formulário de login que aceita requisições ilimitadas sem rate limiting — alguém escreve um script que testa 10 mil senhas por segundo contra uma conta específica até acertar. Ou um endpoint de recuperação de senha que valida códigos sem contar quantas tentativas erradas já houve.

Cómo mitigar

Implemente rate limiting (máximo de tentativas por IP/usuário em janela de tempo), aumente delay exponencial entre tentativas falhadas, bloqueie a conta ou IP temporariamente após N falhas, e use CAPTCHA ou MFA para dificultar automação. Log de tentativas suspeitas é essencial para detecção.

CVE-2023-24080CRITICALA lack of rate limiting on the password reset endpoint of Chamberlain myQ v5.222.0.32277 (on iOS) allows attackers to compromise user accounEPSS 0.9%CVE-2024-38176HIGHGroupMe Elevation of Privilege VulnerabilityEPSS 0.9%CVE-2023-35172HIGHNextcloud Server password reset endpoint is not brute force protectedEPSS 0.9%CVE-2022-45790HIGHOmron FINS memory protection susceptible to bruteforceEPSS 0.9%CVE-2023-35697MEDIUMImproper Restriction of Excessive Authentication Attempts in the SICK ICR890-4 could allow a remote attacker to brute-force user credentialsEPSS 0.9%CVE-2022-24044—A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22), Desigo PXC3 (All versions < V01.21.142.4-18), Desigo PXEPSS 0.9%CVE-2025-9004MEDIUMmtons mblog password excessive authenticationEPSS 0.9%CVE-2023-32320HIGHNextcloud Server's brute force protection allows someone to send more requests than intendedEPSS 0.9%CVE-2025-23368HIGHOrg.wildfly.core:wildfly-elytron-integration: wildfly elytron brute force attack via cliEPSS 0.9%CVE-2025-52392MEDIUMSoosyze CMS 2.0 allows brute-force login attacks via the /user/login endpoint due to missing rate-limiting and lockout mechanisms. An attackEPSS 0.9%CVE-2024-39398HIGHOTP 2FA can be bruteforcedEPSS 0.9%CVE-2022-32757HIGHIBM Security Directory Suite VA information disclosureEPSS 0.9%CVE-2023-32074HIGHNextcloud user_oidc app is missing brute force protectionEPSS 0.9%CVE-2022-2822LOWAuthentication Bypass by Primary Weakness in octoprint/octoprintEPSS 0.8%CVE-2022-33106CRITICALWiJungle NGFW Version U250 was discovered to be vulnerable to No Rate Limit attack, allowing the attacker to brute force the admin password EPSS 0.8%CVE-2024-21662HIGHArgo CD vulnerable to Bypassing of Rate Limit and Brute Force Protection Using Cache OverflowEPSS 0.8%CVE-2025-12547MEDIUMLogicalDOC Community Edition Admin Login login.jsp excessive authenticationEPSS 0.8%CVE-2024-55008HIGHJATOS 3.9.4 contains a denial-of-service (DoS) vulnerability in the authentication system, where an attacker can prevent legitimate users frEPSS 0.8%CVE-2023-33759CRITICALSpliceCom Maximiser Soft PBX v1.5 and before does not restrict excessive authentication attempts, allowing attackers to bypass authenticatioEPSS 0.8%CVE-2023-2531HIGHImproper Restriction of Excessive Authentication Attempts in azuracast/azuracastEPSS 0.8%