CWE-307
AllowedImproper Restriction of Excessive Authentication Attempts
Abstraction: Base · Status: Draft
The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.
903 vulnerabilities reference this CWE, most recent first.
GHSA-CFH2-3F5R-4VF9
Vulnerability from github – Published: 2022-01-26 00:00 – Updated: 2022-02-02 00:02The code that performs password matching when using 'Basic' HTTP authentication does not use a constant-time memcmp and has no rate-limiting. This means that an unauthenticated network attacker can brute-force the HTTP basic password, byte-by-byte, by recording the webserver's response time until the unauthorized (401) response.
{
"affected": [],
"aliases": [
"CVE-2021-43298"
],
"database_specific": {
"cwe_ids": [
"CWE-307"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-01-25T20:15:00Z",
"severity": "CRITICAL"
},
"details": "The code that performs password matching when using \u0027Basic\u0027 HTTP authentication does not use a constant-time memcmp and has no rate-limiting. This means that an unauthenticated network attacker can brute-force the HTTP basic password, byte-by-byte, by recording the webserver\u0027s response time until the unauthorized (401) response.",
"id": "GHSA-cfh2-3f5r-4vf9",
"modified": "2022-02-02T00:02:03Z",
"published": "2022-01-26T00:00:58Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-43298"
},
{
"type": "WEB",
"url": "https://github.com/embedthis/goahead/issues/304"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-CFJM-49PH-8GV8
Vulnerability from github – Published: 2023-10-09 12:30 – Updated: 2024-04-04 08:26Improper Restriction of Excessive Authentication Attempts in RDT400 in SICK APU allows an unprivileged remote attacker to guess the password via trial-and-error as the login attempts are not limited.
{
"affected": [],
"aliases": [
"CVE-2023-43699"
],
"database_specific": {
"cwe_ids": [
"CWE-307"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-10-09T12:15:10Z",
"severity": "HIGH"
},
"details": "\nImproper Restriction of Excessive Authentication Attempts in RDT400 in SICK APU\nallows an unprivileged remote attacker to guess the password via trial-and-error as the login attempts\nare not limited.\n\n",
"id": "GHSA-cfjm-49ph-8gv8",
"modified": "2024-04-04T08:26:05Z",
"published": "2023-10-09T12:30:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-43699"
},
{
"type": "WEB",
"url": "https://sick.com/.well-known/csaf/white/2023/sca-2023-0010.json"
},
{
"type": "WEB",
"url": "https://sick.com/.well-known/csaf/white/2023/sca-2023-0010.pdf"
},
{
"type": "WEB",
"url": "https://sick.com/psirt"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-CG82-JV3X-5FXQ
Vulnerability from github – Published: 2022-05-24 19:08 – Updated: 2022-05-24 19:08Information disclosure in Logon Page in MV's mConnect application v02.001.00 allows an attacker to know valid users from the application's database via brute force.
{
"affected": [],
"aliases": [
"CVE-2020-23283"
],
"database_specific": {
"cwe_ids": [
"CWE-307"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-07-21T15:15:00Z",
"severity": "HIGH"
},
"details": "Information disclosure in Logon Page in MV\u0027s mConnect application v02.001.00 allows an attacker to know valid users from the application\u0027s database via brute force.",
"id": "GHSA-cg82-jv3x-5fxq",
"modified": "2022-05-24T19:08:49Z",
"published": "2022-05-24T19:08:49Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-23283"
},
{
"type": "WEB",
"url": "https://github.com/ifmacedo/mconnect/blob/main/bruteforce"
},
{
"type": "WEB",
"url": "https://www.linkedin.com/pulse/descobrindo-usu%C3%A1rios-brute-force-iran"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-CG84-55JX-4237
Vulnerability from github – Published: 2024-05-15 21:12 – Updated: 2024-05-15 21:12This Security Update fixes a severe vulnerability in the eZ Platform Admin UI, and we recommend that you install it as soon as possible. It affects eZ Platform 2.x.
The functionality for resetting a forgotten password is vulnerable to brute force attack. Depending on configuration and other circumstances an attacker may exploit this to gain control over user accounts. The update ensures such an attack is exceedingly unlikely to succeed.
You may want to consider a configuration change to further strengthen your security. By default a password reset request is valid for 1 hour. Reducing this time will make attacks even more difficult, but ensure there is enough time left to account for email delivery delays, and user delays. See documentation at https://doc.ezplatform.com/en/latest/guide/user_management/#changing-and-recovering-passwords
To install, use Composer to update to one of the "Resolving versions" mentioned above. If you use eZ Platform 2.5, update ezsystems/ezplatform-user to v1.0.1. If you use eZ Platform 2.4, update ezsystems/ezplatform-admin-ui to v1.4.6, and ezsystems/ezplatform-admin-ui-modules to v1.4.4, and ezsystems/repository-forms to v2.4.5)
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "ezsystems/ezplatform-admin-ui"
},
"ranges": [
{
"events": [
{
"introduced": "1.4.0"
},
{
"fixed": "1.4.6"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-307"
],
"github_reviewed": true,
"github_reviewed_at": "2024-05-15T21:12:59Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "This Security Update fixes a severe vulnerability in the eZ Platform Admin UI, and we recommend that you install it as soon as possible. It affects eZ Platform 2.x.\n \nThe functionality for resetting a forgotten password is vulnerable to brute force attack. Depending on configuration and other circumstances an attacker may exploit this to gain control over user accounts. The update ensures such an attack is exceedingly unlikely to succeed.\n \nYou may want to consider a configuration change to further strengthen your security. By default a password reset request is valid for 1 hour. Reducing this time will make attacks even more difficult, but ensure there is enough time left to account for email delivery delays, and user delays. See documentation at https://doc.ezplatform.com/en/latest/guide/user_management/#changing-and-recovering-passwords\n\nTo install, use Composer to update to one of the \"Resolving versions\" mentioned above. If you use eZ Platform 2.5, update ezsystems/ezplatform-user to v1.0.1. If you use eZ Platform 2.4, update ezsystems/ezplatform-admin-ui to v1.4.6, and ezsystems/ezplatform-admin-ui-modules to v1.4.4, and ezsystems/repository-forms to v2.4.5)",
"id": "GHSA-cg84-55jx-4237",
"modified": "2024-05-15T21:12:59Z",
"published": "2024-05-15T21:12:59Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/ezsystems/ezplatform-admin-ui/2019-04-03-1.yaml"
},
{
"type": "PACKAGE",
"url": "https://github.com/ezsystems/ezplatform-admin-ui"
},
{
"type": "WEB",
"url": "https://share.ez.no/community-project/security-advisories/ezsa-2019-002-password-reset-vulnerability"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20210615002251/https://share.ez.no/community-project/security-advisories/ezsa-2019-002-password-reset-vulnerability"
}
],
"schema_version": "1.4.0",
"severity": [],
"summary": "eZ Platform Password reset vulnerability"
}
GHSA-CGPG-X4HH-6J98
Vulnerability from github – Published: 2023-12-20 00:32 – Updated: 2023-12-20 00:32EuroTel ETL3100 versions v01c01 and v01x37 does not limit the number of attempts to guess administrative credentials in remote password attacks to gain full control of the system.
{
"affected": [],
"aliases": [
"CVE-2023-6928"
],
"database_specific": {
"cwe_ids": [
"CWE-307"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-12-19T23:15:08Z",
"severity": "CRITICAL"
},
"details": "\nEuroTel ETL3100 versions v01c01 and v01x37 does not limit the number of attempts to guess administrative credentials in remote password attacks to gain full control of the system.\n\n\n\n\n",
"id": "GHSA-cgpg-x4hh-6j98",
"modified": "2023-12-20T00:32:44Z",
"published": "2023-12-20T00:32:44Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6928"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-353-05"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-CH2J-PQR2-H9JH
Vulnerability from github – Published: 2022-05-24 17:37 – Updated: 2022-05-24 17:37LimitLoginAttempts.php in the limit-login-attempts-reloaded plugin before 2.17.4 for WordPress allows a bypass of (per IP address) rate limits because the X-Forwarded-For header can be forged. When the plugin is configured to accept an arbitrary header for the client source IP address, a malicious user is not limited to perform a brute force attack, because the client IP header accepts any arbitrary string. When randomizing the header input, the login count does not ever reach the maximum allowed retries.
{
"affected": [],
"aliases": [
"CVE-2020-35590"
],
"database_specific": {
"cwe_ids": [
"CWE-307"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-12-21T07:15:00Z",
"severity": "CRITICAL"
},
"details": "LimitLoginAttempts.php in the limit-login-attempts-reloaded plugin before 2.17.4 for WordPress allows a bypass of (per IP address) rate limits because the X-Forwarded-For header can be forged. When the plugin is configured to accept an arbitrary header for the client source IP address, a malicious user is not limited to perform a brute force attack, because the client IP header accepts any arbitrary string. When randomizing the header input, the login count does not ever reach the maximum allowed retries.",
"id": "GHSA-ch2j-pqr2-h9jh",
"modified": "2022-05-24T17:37:07Z",
"published": "2022-05-24T17:37:07Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-35590"
},
{
"type": "WEB",
"url": "https://n4nj0.github.io/advisories/wordpress-plugin-limit-login-attempts-reloaded"
},
{
"type": "WEB",
"url": "https://wordpress.org/plugins/limit-login-attempts-reloaded/#developers"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-CHCR-X7HC-8FP8
Vulnerability from github – Published: 2024-01-12 15:13 – Updated: 2024-03-20 15:34Advisory withdrawn
The backing CVE has been rejected
Devise-Two-Factor does not throttle or otherwise restrict login attempts at the server by default. When combined with the Time-based One Time Password algorithm's (TOTP) inherent entropy limitations, it's possible for an attacker to bypass the 2FA mechanism through brute-force attacks.
Impact
If a user's username and password have already been compromised an attacker would be able to try possible TOTP codes and see if they can hit a lucky collision to log in as that user. The user under attack would not necessarily know that their account has been compromised.
Patches
Devise-Two-Factor has not released any fixes for this vulnerability. This library is open-ended by design and cannot solve this for all applications natively. It's recommended that any application leveraging Devise-Two-Factor implement controls at the application level to mitigate this threat. A non-exhaustive list of possible mitigations can be found below.
Mitigations
- Use the
lockablestrategy from Devise to lock a user after a certain number of failed login attempts. See https://www.rubydoc.info/github/heartcombo/devise/main/Devise/Models/Lockable for more information. - Configure a rate limit for your application, especially on the endpoints used to log in. One such library to accomplish this is rack-attack.
- When displaying authentication errors hide whether validating a username/password combination failed or a two-factor code failed behind a more generic error message.
Acknowledgements
Christian Reitter (Radically Open Security) and Chris MacNaughton (Centauri Solutions)
{
"affected": [
{
"package": {
"ecosystem": "RubyGems",
"name": "devise-two-factor"
},
"ranges": [
{
"events": [
{
"introduced": "1.0.0"
},
{
"last_affected": "5.0.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-0227"
],
"database_specific": {
"cwe_ids": [
"CWE-307"
],
"github_reviewed": true,
"github_reviewed_at": "2024-01-12T15:13:05Z",
"nvd_published_at": "2024-01-11T20:15:44Z",
"severity": "MODERATE"
},
"details": "### Advisory withdrawn\nThe backing CVE has been rejected\n\nDevise-Two-Factor does not throttle or otherwise restrict login attempts at the server by default. When combined with the Time-based One Time Password algorithm\u0027s (TOTP) inherent entropy limitations, it\u0027s possible for an attacker to bypass the 2FA mechanism through brute-force attacks.\n\n### Impact\n\nIf a user\u0027s username and password have already been compromised an attacker would be able to try possible TOTP codes and see if they can hit a lucky collision to log in as that user. The user under attack would not necessarily know that their account has been compromised.\n\n### Patches\n\nDevise-Two-Factor has not released any fixes for this vulnerability. This library is open-ended by design and cannot solve this for all applications natively. It\u0027s recommended that any application leveraging Devise-Two-Factor implement controls at the application level to mitigate this threat. A non-exhaustive list of possible mitigations can be found below.\n\n#### Mitigations\n\n1. Use the `lockable` strategy from Devise to lock a user after a certain number of failed login attempts. See https://www.rubydoc.info/github/heartcombo/devise/main/Devise/Models/Lockable for more information.\n2. Configure a rate limit for your application, especially on the endpoints used to log in. One such library to accomplish this is [rack-attack](https://rubygems.org/gems/rack-attack).\n3. When displaying authentication errors hide whether validating a username/password combination failed or a two-factor code failed behind a more generic error message.\n\n### Acknowledgements\n\nChristian Reitter ([Radically Open Security](https://www.radicallyopensecurity.com/)) and Chris MacNaughton ([Centauri Solutions](https://centauri.solutions))",
"id": "GHSA-chcr-x7hc-8fp8",
"modified": "2024-03-20T15:34:05Z",
"published": "2024-01-12T15:13:05Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/devise-two-factor/devise-two-factor/security/advisories/GHSA-chcr-x7hc-8fp8"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0227"
},
{
"type": "PACKAGE",
"url": "https://github.com/devise-two-factor/devise-two-factor"
},
{
"type": "WEB",
"url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/devise-two-factor/CVE-2024-0227.yml"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
],
"summary": "Devise-Two-Factor vulnerable to brute force attacks",
"withdrawn": "2024-03-19T22:33:55Z"
}
GHSA-CHW4-88XC-79W6
Vulnerability from github – Published: 2023-06-09 03:30 – Updated: 2023-06-16 17:47Improper Restriction of Excessive Authentication Attempts in GitHub repository froxlor/froxlor prior to 2.0.20.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "froxlor/froxlor"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.20"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-3173"
],
"database_specific": {
"cwe_ids": [
"CWE-307"
],
"github_reviewed": true,
"github_reviewed_at": "2023-06-09T22:41:26Z",
"nvd_published_at": "2023-06-09T02:15:09Z",
"severity": "CRITICAL"
},
"details": "Improper Restriction of Excessive Authentication Attempts in GitHub repository froxlor/froxlor prior to 2.0.20.",
"id": "GHSA-chw4-88xc-79w6",
"modified": "2023-06-16T17:47:20Z",
"published": "2023-06-09T03:30:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3173"
},
{
"type": "WEB",
"url": "https://github.com/froxlor/froxlor/commit/464216072456efb35b4541c58e7016463dfbd9a6"
},
{
"type": "PACKAGE",
"url": "https://github.com/froxlor/froxlor"
},
{
"type": "WEB",
"url": "https://huntr.dev/bounties/4d715f76-950d-4251-8139-3dffea798f14"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Froxlor vulnerable to Improper Restriction of Excessive Authentication Attempts"
}
GHSA-CJ6Q-74J6-GVJM
Vulnerability from github – Published: 2022-05-13 01:43 – Updated: 2022-05-13 01:43htdocs/parentalcontrols/bind.php on D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) devices does not prevent unauthenticated nonce-guessing attacks, which makes it easier for remote attackers to change the DNS configuration via a series of requests.
{
"affected": [],
"aliases": [
"CVE-2017-14423"
],
"database_specific": {
"cwe_ids": [
"CWE-307"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-09-13T17:29:00Z",
"severity": "HIGH"
},
"details": "htdocs/parentalcontrols/bind.php on D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) devices does not prevent unauthenticated nonce-guessing attacks, which makes it easier for remote attackers to change the DNS configuration via a series of requests.",
"id": "GHSA-cj6q-74j6-gvjm",
"modified": "2022-05-13T01:43:25Z",
"published": "2022-05-13T01:43:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-14423"
},
{
"type": "WEB",
"url": "https://pierrekim.github.io/blog/2017-09-08-dlink-850l-mydlink-cloud-0days-vulnerabilities.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-CJ7W-F46Q-RMP6
Vulnerability from github – Published: 2025-03-28 15:31 – Updated: 2025-03-28 15:31Unauthorised access to the call forwarding service system in MeetMe products in versions prior to 2024-09 allows an attacker to identify multiple users and perform brute force attacks via extensions.
{
"affected": [],
"aliases": [
"CVE-2025-2911"
],
"database_specific": {
"cwe_ids": [
"CWE-307"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-28T13:15:41Z",
"severity": "MODERATE"
},
"details": "Unauthorised access to the call forwarding service system in MeetMe products in versions prior to 2024-09 allows an attacker to identify multiple users and perform brute force attacks via extensions.",
"id": "GHSA-cj7w-f46q-rmp6",
"modified": "2025-03-28T15:31:56Z",
"published": "2025-03-28T15:31:56Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2911"
},
{
"type": "WEB",
"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-fermax-mobile-applications"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
Mitigation
- Common protection mechanisms include:
- Disconnecting the user after a small number of failed attempts
- Implementing a timeout
- Locking out a targeted account
- Requiring a computational task on the user's part.
Mitigation MIT-4
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482].
- Consider using libraries with authentication capabilities such as OpenSSL or the ESAPI Authenticator. [REF-45]
CAPEC-16: Dictionary-based Password Attack
An attacker tries each of the words in a dictionary as passwords to gain access to the system via some user's account. If the password chosen by the user was a word within the dictionary, this attack will be successful (in the absence of other mitigations). This is a specific instance of the password brute forcing attack pattern.
Dictionary Attacks differ from similar attacks such as Password Spraying (CAPEC-565) and Credential Stuffing (CAPEC-600), since they leverage unknown username/password combinations and don't care about inducing account lockouts.
CAPEC-49: Password Brute Forcing
An adversary tries every possible value for a password until they succeed. A brute force attack, if feasible computationally, will always be successful because it will essentially go through all possible passwords given the alphabet used (lower case letters, upper case letters, numbers, symbols, etc.) and the maximum length of the password.
CAPEC-560: Use of Known Domain Credentials
An adversary guesses or obtains (i.e. steals or purchases) legitimate credentials (e.g. userID/password) to achieve authentication and to perform authorized actions under the guise of an authenticated user or service.
CAPEC-565: Password Spraying
In a Password Spraying attack, an adversary tries a small list (e.g. 3-5) of common or expected passwords, often matching the target's complexity policy, against a known list of user accounts to gain valid credentials. The adversary tries a particular password for each user account, before moving onto the next password in the list. This approach assists the adversary in remaining undetected by avoiding rapid or frequent account lockouts. The adversary may then reattempt the process with additional passwords, once enough time has passed to prevent inducing a lockout.
CAPEC-600: Credential Stuffing
An adversary tries known username/password combinations against different systems, applications, or services to gain additional authenticated access. Credential Stuffing attacks rely upon the fact that many users leverage the same username/password combination for multiple systems, applications, and services.
CAPEC-652: Use of Known Kerberos Credentials
An adversary obtains (i.e. steals or purchases) legitimate Kerberos credentials (e.g. Kerberos service account userID/password or Kerberos Tickets) with the goal of achieving authenticated access to additional systems, applications, or services within the domain.
CAPEC-653: Use of Known Operating System Credentials
An adversary guesses or obtains (i.e. steals or purchases) legitimate operating system credentials (e.g. userID/password) to achieve authentication and to perform authorized actions on the system, under the guise of an authenticated user or service. This applies to any Operating System.