Falhas do tipo CWE-307

431 resultados

Falta de proteção contra tentativas excessivas de autenticação

A aplicação não limita ou não desacelera tentativas de login, permitindo que um atacante teste múltiplas credenciais rapidamente (força bruta, dicionário ou spray de senhas). Sem controle, a conta fica vulnerável a comprometimento, especialmente se senhas fracas forem usadas.

Exemplo

Um endpoint de login que aceita 10 mil requisições por segundo sem nenhuma restrição. Um atacante automatiza tentativas com senhas comuns contra mil usuários até acertar credenciais válidas em poucos minutos.

Como mitigar

Implemente rate limiting (máximo de tentativas por IP/usuário em período curto), atrasos progressivos (backoff exponencial) após falhas, bloqueio temporário de conta após N tentativas, e idealmente autenticação multifator para reduzir o dano de senhas comprometidas.

CVE-2023-21709CRITICALMicrosoft Exchange Server Elevation of Privilege VulnerabilityEPSS 1.9%CVE-2023-26208LOWA improper restriction of excessive authentication attempts vulnerability [CWE-307] in Fortinet FortiAuthenticator 6.4.x and before allows EPSS 1.8%CVE-2022-29056LOWA improper restriction of excessive authentication attempts vulnerability [CWE-307] in Fortinet FortiMail version 6.4.0, version 6.2.0 throuEPSS 1.8%CVE-2020-25196CRITICALMOXA NPort IAW5000A-I/O SeriesEPSS 1.8%CVE-2023-27746CRITICALBlackVue DR750-2CH LTE v.1.012_2022.10.26 was discovered to contain a weak default passphrase which can be easily cracked via a brute force EPSS 1.8%CVE-2023-26209LOWA improper restriction of excessive authentication attempts vulnerability [CWE-307] in Fortinet FortiDeceptor 3.1.x and before allows a remEPSS 1.7%CVE-2021-22915—Nextcloud server before 19.0.11, 20.0.10, 21.0.2 is vulnerable to brute force attacks due to lack of inclusion of IPv6 subnets in rate-limitEPSS 1.7%CVE-2026-44596MEDIUMYamcs: No Rate Limiting on Authentication EndpointEPSS 1.7%CVE-2024-5716HIGHLogsign Unified SecOps Platform Authentication Bypass VulnerabilityEPSS 1.6%CVE-2020-11052HIGHImproper Restriction of Excessive Authentication Attempts in SorceryEPSS 1.6%CVE-2017-7915—An Improper Restriction of Excessive Authentication Attempts issue was discovered in Moxa OnCell G3110-HSPA Version 1.3 build 15082117 and pEPSS 1.5%CVE-2019-13918—A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V2.0 SP1). The web interface has no means to prevent pasEPSS 1.5%CVE-2022-2321HIGHImproper Restriction of Excessive Authentication Attempts in heroiclabs/nakamaEPSS 1.5%CVE-2020-15786CRITICALA vulnerability has been identified in SIMATIC HMI Basic Panels 2nd Generation (incl. SIPLUS variants) (All versions < V16), SIMATIC HMI ComEPSS 1.5%CVE-2022-26314—A vulnerability has been identified in Mendix Forgot Password Appstore module (All versions >= V3.3.0 < V3.5.1), Mendix Forgot Password AppsEPSS 1.5%CVE-2020-7525—Improper Restriction of Excessive Authentication Attempts vulnerability exists in all hardware versions of spaceLYnk and Wiser for KNX (formEPSS 1.5%CVE-2019-18235—Advantech Spectre RT ERT351 Versions 5.1.3 and prior has insufficient login authentication parameters required for the web application may aEPSS 1.5%CVE-2021-43958CRITICALVarious rest resources in Fisheye and Crucible before version 4.8.9 allowed remote attackers to brute force user login credentials as rest rEPSS 1.5%CVE-2020-7508—A CWE-307 Improper Restriction of Excessive Authentication Attempts vulnerability exists in Easergy T300 (Firmware version 1.5.2 and older) EPSS 1.4%CVE-2023-32224CRITICALD-Link DSL-224 firmware version 3.0.10 CWE-307: Improper Restriction of Excessive Authentication AttemptsEPSS 1.4%