Fallos del tipo CWE-307

435 resultados

Falta de limitação em tentativas de autenticação

É quando a aplicação não restringe adequadamente quantas vezes um atacante pode tentar adivinhar credenciais (senha, PIN, código MFA). Sem limite de tentativas ou delay entre elas, força bruta fica viável: o atacante testa combinações até encontrar a senha correta.

Ejemplo

Um formulário de login que aceita requisições ilimitadas sem rate limiting — alguém escreve um script que testa 10 mil senhas por segundo contra uma conta específica até acertar. Ou um endpoint de recuperação de senha que valida códigos sem contar quantas tentativas erradas já houve.

Cómo mitigar

Implemente rate limiting (máximo de tentativas por IP/usuário em janela de tempo), aumente delay exponencial entre tentativas falhadas, bloqueie a conta ou IP temporariamente após N falhas, e use CAPTCHA ou MFA para dificultar automação. Log de tentativas suspeitas é essencial para detecção.

CVE-2021-41171MEDIUMBypass bruteforce protection on login form in elabftwEPSS 1.9%CVE-2023-26208LOWA improper restriction of excessive authentication attempts vulnerability [CWE-307] in Fortinet FortiAuthenticator 6.4.x and before allows EPSS 1.8%CVE-2022-29056LOWA improper restriction of excessive authentication attempts vulnerability [CWE-307] in Fortinet FortiMail version 6.4.0, version 6.2.0 throuEPSS 1.8%CVE-2020-25196CRITICALMOXA NPort IAW5000A-I/O SeriesEPSS 1.8%CVE-2023-27746CRITICALBlackVue DR750-2CH LTE v.1.012_2022.10.26 was discovered to contain a weak default passphrase which can be easily cracked via a brute force EPSS 1.8%CVE-2023-26209LOWA improper restriction of excessive authentication attempts vulnerability [CWE-307] in Fortinet FortiDeceptor 3.1.x and before allows a remEPSS 1.7%CVE-2021-22915—Nextcloud server before 19.0.11, 20.0.10, 21.0.2 is vulnerable to brute force attacks due to lack of inclusion of IPv6 subnets in rate-limitEPSS 1.7%CVE-2026-44596MEDIUMYamcs: No Rate Limiting on Authentication EndpointEPSS 1.7%CVE-2024-5716HIGHLogsign Unified SecOps Platform Authentication Bypass VulnerabilityEPSS 1.6%CVE-2020-11052HIGHImproper Restriction of Excessive Authentication Attempts in SorceryEPSS 1.6%CVE-2017-7915—An Improper Restriction of Excessive Authentication Attempts issue was discovered in Moxa OnCell G3110-HSPA Version 1.3 build 15082117 and pEPSS 1.5%CVE-2019-13918—A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V2.0 SP1). The web interface has no means to prevent pasEPSS 1.5%CVE-2022-2321HIGHImproper Restriction of Excessive Authentication Attempts in heroiclabs/nakamaEPSS 1.5%CVE-2020-15786CRITICALA vulnerability has been identified in SIMATIC HMI Basic Panels 2nd Generation (incl. SIPLUS variants) (All versions < V16), SIMATIC HMI ComEPSS 1.5%CVE-2022-26314—A vulnerability has been identified in Mendix Forgot Password Appstore module (All versions >= V3.3.0 < V3.5.1), Mendix Forgot Password AppsEPSS 1.5%CVE-2020-7525—Improper Restriction of Excessive Authentication Attempts vulnerability exists in all hardware versions of spaceLYnk and Wiser for KNX (formEPSS 1.5%CVE-2019-18235—Advantech Spectre RT ERT351 Versions 5.1.3 and prior has insufficient login authentication parameters required for the web application may aEPSS 1.5%CVE-2021-43958CRITICALVarious rest resources in Fisheye and Crucible before version 4.8.9 allowed remote attackers to brute force user login credentials as rest rEPSS 1.5%CVE-2020-7508—A CWE-307 Improper Restriction of Excessive Authentication Attempts vulnerability exists in Easergy T300 (Firmware version 1.5.2 and older) EPSS 1.4%CVE-2023-32224CRITICALD-Link DSL-224 firmware version 3.0.10 CWE-307: Improper Restriction of Excessive Authentication AttemptsEPSS 1.4%