cve.bz

CWE-307: Improper Restriction of Excessive Authentication Attempts, page 11

Filter

The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.

What the weakness is: CWE-307 at MITRE. OWASP Top 10: A07:2025 Authentication Failures

Related attack patterns (CAPEC): 7
  • CAPEC-16 Dictionary-based Password Attack Likelihood: Medium · Severity: High
  • CAPEC-49 Password Brute Forcing Likelihood: Medium · Severity: High
  • CAPEC-560 Use of Known Domain Credentials Likelihood: High · Severity: High
  • CAPEC-565 Password Spraying Likelihood: High · Severity: High
  • CAPEC-600 Credential Stuffing Likelihood: High · Severity: High
  • CAPEC-652 Use of Known Kerberos Credentials Likelihood: Medium · Severity: High
  • CAPEC-653 Use of Known Operating System Credentials Likelihood: High · Severity: High

The attack patterns MITRE's CAPEC relates to CWE-307, as MITRE names them. Credits.

Ask an AI about CWE-307

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-307: Improper Restriction of Excessive Authentication Attempts and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/307.html and https://cve.bz/cve/cwe/307?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 5.3CVE-2022-3945EPSS 1.0%

    Improper Restriction of Excessive Authentication Attempts in GitHub repository kareadita/kavita prior to 0.6.0.3.

  2. 9.8CVE-2022-27516EPSS 0.7%

    User login brute force protection functionality bypass

  3. 5.3CVE-2022-44023EPSS 0.9%

    PwnDoc through 0.5.3 might allow remote attackers to identify disabled user account names by leveraging response messages for authentication attempts.

  4. 5.3CVE-2022-44022EPSS 0.9%

    PwnDoc through 0.5.3 might allow remote attackers to identify valid user account names by leveraging response timings for authentication attempts.

  5. 9.8CVE-2022-3741EPSS 1.2%

    Impact varies for each individual vulnerability in the application. For generation of accounts, it may be possible, depending on the amount of system resources available, to create a DoS event in the server. These accounts still need to be…

  6. 3.7CVE-2022-39314EPSS 0.4%

    Kirby is a flat-file CMS. In versions prior to 3.5.8.2, 3.6.6.2, 3.7.5.1, and 3.8.1, Kirby is subject to user enumeration due to Improper Restriction of Excessive Authentication Attempts. This vulnerability affects you only if you are usin…

  7. 9.8CVE-2022-35846EPSS 0.9%

    An improper restriction of excessive authentication attempts vulnerability [CWE-307] in FortiTester Telnet port 2.3.0 through 3.9.1, 4.0.0 through 4.2.0, 7.0.0 through 7.1.0 may allow an unauthenticated attacker to guess the credentials of…

  8. 9.8CVE-2022-40055EPSS 0.8%

    An issue in GX Group GPON ONT Titanium 2122A T2122-V1.26EXL allows attackers to escalate privileges via a brute force attack at the login page.

  9. 7.5CVE-2022-3031EPSS 0.7%

    An issue has been discovered in GitLab CE/EE affecting all versions before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3 before 15.3.2. It may be possible for an attacker to guess a user's password …

  10. 9.8CVE-2022-31228EPSS 0.9%

    Dell EMC XtremIO versions prior to X2 6.4.0-22 contain a bruteforce vulnerability. A remote unauthenticated attacker can potentially exploit this vulnerability and gain access to an admin account.

  11. 9.8CVE-2022-33106EPSS 1.0%

    WiJungle NGFW Version U250 was discovered to be vulnerable to No Rate Limit attack, allowing the attacker to brute force the admin password leading to Account Take Over.

  12. 5.3CVE-2022-36781EPSS 0.6%

    ConnectWise ScreenConnect versions 22.6 and below contained a flaw allowing potential brute force attacks on custom access tokens due to inadequate rate-limiting controls in the default configuration. Attackers could exploit this vulnerabi…

  13. 6.5CVE-2022-33735EPSS 0.2%

    There is a password verification vulnerability in WS7200-10 11.0.2.13. Attackers on the LAN may use brute force cracking to obtain passwords, which may cause sensitive system information to be disclosed.

  14. 7.5CVE-2022-37145EPSS 1.0%

    The PlexTrac platform prior to version 1.17.0 does not restrict excessive authentication attempts for accounts configured to use the PlexTrac authentication provider. An unauthenticated remote attacker could perform a bruteforce attack on …

  15. 8.8CVE-2022-37144EPSS 1.0%

    The PlexTrac platform prior to API version 1.17.0 does not restrict excessive MFA TOTP submission attempts. An unauthenticated remote attacker in possession of a valid username and password can bruteforce their way past MFA protections to …

  16. 7.5CVE-2022-2822EPSS 0.9%

    An attacker can freely brute force username and password and can takeover any account. An attacker could easily guess user passwords and gain access to user and administrative accounts.

  17. 5.3CVE-2022-35932EPSS 1.4%

    Nextcloud Talk is a video and audio conferencing app for Nextcloud. Prior to versions 12.2.7, 13.0.7, and 14.0.3, password protected conversations are susceptible to brute force attacks if the attacker has the link/conversation token. It i…

  18. 9.8CVE-2022-2457EPSS 0.6%

    A flaw was found in Red Hat Process Automation Manager 7 where an attacker can benefit from a brute force attack against Administration Console as the application does not limit the number of unsuccessful login attempts.

  19. 9.8CVE-2022-35490EPSS 0.9%

    Zammad 5.2.0 is vulnerable to privilege escalation. Zammad has a prevention against brute-force attacks trying to guess login credentials. After a configurable amount of attempts, users are invalidated and logins prevented. An attacker mig…

  20. 5.3CVE-2022-31118EPSS 0.8%

    Nextcloud server is an open source personal cloud solution. In affected versions an attacker could brute force to find if federated sharing is being used and potentially try to brute force access tokens for federated shares (`a-zA-Z0-9` ^ …

  21. 9.8CVE-2022-35925EPSS 1.8%

    BookWyrm is a social network for tracking reading. Versions prior to 0.4.5 were found to lack rate limiting on authentication views which allows brute-force attacks. This issue has been patched in version 0.4.5. Admins with existing instan…

  22. 9.8CVE-2021-22640EPSS 0.8%

    An attacker can decrypt the Ovarro TBox login password by communication capture and brute force attacks.

  23. 9.8CVE-2022-31234EPSS 1.1%

    Dell EMC PowerStore, contain(s) an Improper Restriction of Excessive Authentication Attempts Vulnerability in PowerStore Manager GUI. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to password brute…

  24. 5.3CVE-2022-24689EPSS 0.9%

    An issue was discovered in DSK DSKNet 2.16.136.0 and 2.17.136.5. It mishandles access control. This allows a remote attacker to access account information pages (including personal data) without being authenticated. The collected informati…

  25. 7.5CVE-2022-22452EPSS 1.0%

    IBM Security Verify Identity Manager 10.0 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 224918.

  26. 9.8CVE-2022-2321EPSS 1.6%

    Improper Restriction of Excessive Authentication Attempts in GitHub repository heroiclabs/nakama prior to 3.13.0. This results in login brute-force attacks.

  27. 6.5CVE-2022-22496EPSS 0.4%

    While a user account for the IBM Spectrum Protect Server 8.1.0.000 through 8.1.14 is being established, it may be configured to use SESSIONSECURITY=TRANSITIONAL. While in this mode, it may be susceptible to an offline dictionary attack. IB…

  28. 9.8CVE-2022-22487EPSS 1.5%

    An IBM Spectrum Protect storage agent could allow a remote attacker to perform a brute force attack by allowing unlimited attempts to login to the storage agent without locking the administrative ID. A remote attacker could exploit this vu…

  29. 9.8CVE-2022-22485EPSS 1.1%

    In some cases, an unsuccessful attempt to log into IBM Spectrum Protect Operations Center 8.1.0.000 through 8.1.14.000 does not cause the administrator's invalid sign-on count to be incremented on the IBM Spectrum Protect Server. An attack…

  30. 9.8CVE-2022-31273EPSS 1.0%

    An issue in TopIDP3000 Topsec Operating System tos_3.3.005.665b.15_smpidp allows attackers to perform a brute-force attack via a crafted session_id cookie.

  31. 4.6CVE-2022-28386EPSS 0.5%

    An issue was discovered in certain Verbatim drives through 2022-03-31. The security feature for lockout (e.g., requiring a reformat of the drive after 20 failed unlock attempts) does not work as specified. More than 20 attempts may be made…

  32. 5.5CVE-2022-28384EPSS 0.4%

    An issue was discovered in certain Verbatim drives through 2022-03-31. Due to an insecure design, they allow an offline brute-force attack for determining the correct passcode, and thus gaining unauthorized access to the stored encrypted d…

  33. 9.8CVE-2022-30235EPSS 1.0%

    A CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could allow unauthorized access when an attacker uses brute force. Affected Products: Wiser Smart, EER21000 & EER21001 (V4.5 and prior)

  34. 9.8CVE-2022-29084EPSS 2.0%

    Dell Unity, Dell UnityVSA, and Dell Unity XT versions before 5.2.0.0.5.173 do not restrict excessive authentication attempts in Unisphere GUI. A remote unauthenticated attacker may potentially exploit this vulnerability to brute-force pass…

  35. 9.8CVE-2013-10004EPSS 1.0%

    A vulnerability classified as critical was found in Telecommunication Software SAMwin Contact Center Suite 5.1. This vulnerability affects the function passwordScramble in the library SAMwinLIBVB.dll of the component Password Handler. Inco…

  36. 7.5CVE-2022-24044EPSS 0.9%

    A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22), Desigo PXC3 (All versions < V01.21.142.4-18), Desigo PXC4 (All versions < V02.20.142.10-10884), Desigo PXC5 (All versions < V02.20.142.10-10884). The logi…

  37. 5.5CVE-2022-26519EPSS 0.2%

    There is no limit to the number of attempts to authenticate for the local configuration pages for the Hills ComNav Version 3002-19 interface, which allows local attackers to brute-force credentials.

  38. 9.8CVE-2022-22561EPSS 1.4%

    Dell PowerScale OneFS, versions 8.2.x-9.3.0.x, contain an improper restriction of excessive authentication attempts. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to compromised accounts.

  39. 9.8CVE-2021-43958EPSS 1.5%

    Various rest resources in Fisheye and Crucible before version 4.8.9 allowed remote attackers to brute force user login credentials as rest resources did not check if users were beyond their max failed login limits and therefore required so…

  40. 4.6CVE-2022-25820EPSS 0.1%

    A vulnerable design in fingerprint matching algorithm prior to SMR Mar-2022 Release 1 allows physical attackers to perform brute force attack on screen lock password.

  41. 9.8CVE-2022-26314EPSS 1.5%

    A vulnerability has been identified in Mendix Forgot Password Appstore module (All versions >= V3.3.0 < V3.5.1), Mendix Forgot Password Appstore module (Mendix 7 compatible) (All versions < V3.2.2). Initial passwords are generated in an in…

  42. 9.8CVE-2022-22810EPSS 1.1%

    A CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could allow an attacker to manipulate the admin after numerous attempts at guessing credentials. Affected Product: spaceLYnk (V2.6.2 and prior),…

  43. 7.5CVE-2021-22818EPSS 1.0%

    A CWE-307 Improper Restriction of Excessive Authentication Attempts vulnerability exists that could allow an attacker to gain unauthorized access to the charging station web interface by performing brute force attacks. Affected Products: E…

  44. 9.8CVE-2021-43298EPSS 2.3%

    The code that performs password matching when using 'Basic' HTTP authentication does not use a constant-time memcmp and has no rate-limiting. This means that an unauthenticated network attacker can brute-force the HTTP basic password, byte…

  45. 9.8CVE-2022-22553EPSS 1.1%

    Dell EMC AppSync versions 3.9 to 4.3 contain an Improper Restriction of Excessive Authentication Attempts Vulnerability that can be exploited from UI and CLI. An adjacent unauthenticated attacker could potentially exploit this vulnerabilit…

  46. 9.8CVE-2021-41807EPSS 1.1%

    Lack of rate limiting in M-Files Server and M-Files Web products with versions before 21.12.10873.0 in certain type of user accounts allows unlimited amount of attempts and therefore makes brute-forcing login accounts easier.

  47. 9.8CVE-2020-21238EPSS 1.0%

    An issue in the user login box of CSCMS v4.0 allows attackers to hijack user accounts via brute force attacks.

  48. 9.8CVE-2020-21237EPSS 1.1%

    An issue in the user login box of LJCMS v1.11 allows attackers to hijack user accounts via brute force attacks.

  49. 8.1CVE-2021-36750EPSS 14%

    ENC DataVault before 7.2 and VaultAPI v67 mishandle key derivation, making it easier for attackers to determine the passwords of all DataVault users (across USB drives sold under multiple brand names).

  50. 9.8CVE-2021-37934EPSS 1.6%

    Due to insufficient server-side login-attempt limit enforcement, a vulnerability in /account/login in Huntflow Enterprise before 3.10.14 could allow an unauthenticated, remote user to perform multiple login attempts for brute-force passwor…