Fallos del tipo CWE-307

484 resultados

Falta de limitação em tentativas de autenticação

É quando a aplicação não restringe adequadamente quantas vezes um atacante pode tentar adivinhar credenciais (senha, PIN, código MFA). Sem limite de tentativas ou delay entre elas, força bruta fica viável: o atacante testa combinações até encontrar a senha correta.

Ejemplo

Um formulário de login que aceita requisições ilimitadas sem rate limiting — alguém escreve um script que testa 10 mil senhas por segundo contra uma conta específica até acertar. Ou um endpoint de recuperação de senha que valida códigos sem contar quantas tentativas erradas já houve.

Cómo mitigar

Implemente rate limiting (máximo de tentativas por IP/usuário em janela de tempo), aumente delay exponencial entre tentativas falhadas, bloqueie a conta ou IP temporariamente após N falhas, e use CAPTCHA ou MFA para dificultar automação. Log de tentativas suspeitas é essencial para detecção.

CVE-2022-32515HIGHA CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could cause brute force attacks to take over EPSS 0.6%CVE-2023-0574MEDIUMServer-Side Request ForgeryEPSS 0.6%CVE-2024-43042CRITICALPluck CMS 4.7.18 does not restrict failed login attempts, allowing attackers to execute a brute force attack.EPSS 0.6%CVE-2022-43377HIGH A CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could cause account takeover when a brutEPSS 0.6%CVE-2023-29005HIGHNo Rate Limiting on Login AUTH DBEPSS 0.6%CVE-2025-8927MEDIUMmtons mblog Verification Code send_code excessive authenticationEPSS 0.6%CVE-2023-1665HIGHImproper Restriction of Excessive Authentication Attempts in linagora/twakeEPSS 0.6%CVE-2026-8760CRITICALLogin with OTP <= 1.6 - Unauthenticated Authentication Bypass via OTP Brute ForceEPSS 0.6%CVE-2023-1539MEDIUMImproper Restriction of Excessive Authentication Attempts in answerdev/answerEPSS 0.6%CVE-2023-50123HIGHThe number of attempts to bring the Hozard Alarm system (alarmsystemen) v1.0 to a disarmed state is not limited. This could allow an attackeEPSS 0.6%CVE-2026-85734CRITICALLightRAG: No Rate Limiting on /login Endpoint Allows Brute-Force AttacksEPSS 0.6%CVE-2026-91973HIGHVikunja before 2.6.0 Authentication Bypass via CalDAV BasicAuthEPSS 0.6%CVE-2022-23746HIGHThe IPsec VPN blade has a dedicated portal for downloading and connecting through SSL Network Extender (SNX). If the portal is configured foEPSS 0.6%CVE-2024-39917HIGHxrdp allows an ininite number of login attemptsEPSS 0.6%CVE-2025-11441MEDIUMJhumanJ OpnForm HTTP Header excessive authenticationEPSS 0.6%CVE-2023-25818MEDIUMMissing brute force protection on password reset token in Nextcloud ServerEPSS 0.6%CVE-2026-27778HIGHePower epower.ie Improper Restriction of Excessive Authentication AttemptsEPSS 0.6%CVE-2023-46745MEDIUMRate limiting Bypass on login page in libreNMSEPSS 0.6%CVE-2025-56221CRITICALA lack of rate limiting in the login mechanism of SigningHub v8.6.8 allows attackers to bypass authentication via a brute force attack.EPSS 0.6%CVE-2022-2457MEDIUMA flaw was found in Red Hat Process Automation Manager 7 where an attacker can benefit from a brute force attack against Administration ConsEPSS 0.6%