Falhas do tipo CWE-307

484 resultados

Falta de proteção contra tentativas excessivas de autenticação

A aplicação não limita ou não desacelera tentativas de login, permitindo que um atacante teste múltiplas credenciais rapidamente (força bruta, dicionário ou spray de senhas). Sem controle, a conta fica vulnerável a comprometimento, especialmente se senhas fracas forem usadas.

Exemplo

Um endpoint de login que aceita 10 mil requisições por segundo sem nenhuma restrição. Um atacante automatiza tentativas com senhas comuns contra mil usuários até acertar credenciais válidas em poucos minutos.

Como mitigar

Implemente rate limiting (máximo de tentativas por IP/usuário em período curto), atrasos progressivos (backoff exponencial) após falhas, bloqueio temporário de conta após N tentativas, e idealmente autenticação multifator para reduzir o dano de senhas comprometidas.

CVE-2022-3031LOWAn issue has been discovered in GitLab CE/EE affecting all versions before 15.1.6, all versions starting from 15.2 before 15.2.4, all versioEPSS 0.6%CVE-2023-36917MEDIUMPassword Change rate limit bypass in SAP BusinessObjects Business Intelligence PlatformEPSS 0.6%CVE-2026-56450MEDIUMAIL Framework - Missing Rate Limiting Enables Brute-Force Attacks Against Two-Factor Authentication CodesEPSS 0.6%CVE-2026-14254HIGHImproper Restriction of Excessive Authentication Attempts in Delphix Continuous DataEPSS 0.6%CVE-2023-39960MEDIUMNextcloud Server has improper restriction of excessive authentication attempts on WebDAV endpointEPSS 0.6%CVE-2024-49597HIGHDell Wyse Management Suite, versions WMS 4.4 and prior, contain an Improper Restriction of Excessive Authentication Attempts vulnerability. EPSS 0.6%CVE-2025-8742MEDIUMmacrozheng mall Admin Login excessive authenticationEPSS 0.6%CVE-2024-51558CRITICALBrute Force Attack Vulnerability in Wave 2.0EPSS 0.6%CVE-2026-7671MEDIUMCodeWise Tornet Scooter Mobile App TwoFactor excessive authenticationEPSS 0.6%CVE-2026-35098MEDIUMImproper Restriction of Excessive Authentication Attempts in KTM System e-BOKEPSS 0.6%CVE-2024-45790CRITICALUser Enumeration vulnerabilityEPSS 0.6%CVE-2024-47088CRITICALUser Enumeration vulnerabilityEPSS 0.6%CVE-2026-93650MEDIUMSaleor throttling.py get_client_ip excessive authenticationEPSS 0.6%CVE-2023-3548HIGHIQ Wifi 6EPSS 0.5%CVE-2023-42480MEDIUMInformation Disclosure in NetWeaver AS Java LogonEPSS 0.5%CVE-2024-46442CRITICALAn issue in the BYD Dilink Headunit System v3.0 to v4.0 allows attackers to bypass authentication via a bruteforce attack.EPSS 0.5%CVE-2025-27456HIGHCVE-2025-27456EPSS 0.5%CVE-2025-1710HIGHCVE-2025-1710EPSS 0.5%CVE-2025-27449HIGHCVE-2025-27449EPSS 0.5%CVE-2025-11566MEDIUMCWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that would allow an attacker on the local network toEPSS 0.5%