CWE-307: Improper Restriction of Excessive Authentication Attempts, page 12
Filter
The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.
What the weakness is: CWE-307 at MITRE. OWASP Top 10: A07:2025 Authentication Failures
Related attack patterns (CAPEC): 7
- CAPEC-16 Dictionary-based Password Attack Likelihood: Medium · Severity: High
- CAPEC-49 Password Brute Forcing Likelihood: Medium · Severity: High
- CAPEC-560 Use of Known Domain Credentials Likelihood: High · Severity: High
- CAPEC-565 Password Spraying Likelihood: High · Severity: High
- CAPEC-600 Credential Stuffing Likelihood: High · Severity: High
- CAPEC-652 Use of Known Kerberos Credentials Likelihood: Medium · Severity: High
- CAPEC-653 Use of Known Operating System Credentials Likelihood: High · Severity: High
The attack patterns MITRE's CAPEC relates to CWE-307, as MITRE names them. Credits.
Ask an AI about CWE-307
Show the prompt
Explain CWE-307: Improper Restriction of Excessive Authentication Attempts and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/307.html and https://cve.bz/cve/cwe/307?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 9.8CVE-2021-42544EPSS 1.4%
Missing Rate Limiting in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 on the Login Form allows an unauthenticated remote attacker to perform multiple login attempts, which facilitates gain…
- 7.5CVE-2021-38890EPSS 1.6%
IBM Sterling Connect:Direct Web Services 1.0 and 6.0 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 209507.
- 9.8CVE-2021-41435EPSS 6.5%
A brute-force protection bypass in CAPTCHA protection in ASUS ROG Rapture GT-AX11000, RT-AX3000, RT-AX55, RT-AX56U, RT-AX56U_V2, RT-AX58U, RT-AX82U, RT-AX82U GUNDAM EDITION, RT-AX86 Series(RT-AX86U/RT-AX86S), RT-AX86U ZAKU II EDITION, RT-A…
- 6.8CVE-2021-44033EPSS 0.5%
In Ionic Identity Vault before 5.0.5, the protection mechanism for invalid unlock attempts can be bypassed.
- 5.3CVE-2021-33209EPSS 0.8%
An issue was discovered in Fimer Aurora Vision before 2.97.10. The response to a failed login attempt discloses whether the username or password is wrong, helping an attacker to enumerate usernames. This can make a brute-force attack easie…
- 8.8CVE-2021-41171EPSS 1.9%
eLabFTW is an open source electronic lab notebook manager for research teams. In versions of eLabFTW before 4.1.0, it allows attackers to bypass a brute-force protection mechanism by using many different forged PHPSESSID values in HTTP Coo…
- 4.3CVE-2021-42096EPSS 1.2%
GNU Mailman before 2.1.35 may allow remote Privilege Escalation. A certain csrf_token value is derived from the admin password, and may be useful in conducting a brute-force attack against that password.
- 9.8CVE-2021-38474EPSS 0.7%
InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 have has no account lockout policy configured for the login page of the product. This may allow an attacker to execute a brute-force password attack with no time limitatio…
- 4.4CVE-2021-36285EPSS 0.2%
Dell BIOS contains an Improper Restriction of Excessive Authentication Attempts vulnerability. A local authenticated malicious administrator could exploit this vulnerability to bypass excessive NVMe password attempt mitigations in order to…
- 4.4CVE-2021-36284EPSS 0.2%
Dell BIOS contains an Improper Restriction of Excessive Authentication Attempts vulnerability. A local authenticated malicious administrator could exploit this vulnerability to bypass excessive admin password attempt mitigations in order t…
- 5.3CVE-2021-29842EPSS 1.3%
IBM WebSphere Application Server 7.0, 8.0, 8.5, 9.0 and Liberty 17.0.0.3 through 21.0.0.9 could allow a remote user to enumerate usernames due to a difference of responses from valid and invalid login attempts. IBM X-Force ID: 205202.
- 9.8CVE-2021-28911EPSS 1.7%
BAB TECHNOLOGIE GmbH eibPort V3 prior version 3.9.1 allow unauthenticated attackers access to /tmp path which contains some sensitive data (e.g. device serial number). Having those info, a possible loginId can be self-calculated in a brute…
- 9.8CVE-2021-28909EPSS 1.4%
BAB TECHNOLOGIE GmbH eibPort V3 prior version 3.9.1 allow unauthenticated attackers to access uncontrolled the login service at /webif/SecurityModule in a brute force attack. The password could be weak and default username is known as 'adm…
- 5.3CVE-2021-38725EPSS 0.9%
Fuel CMS 1.5.0 has a brute force vulnerability in fuel/modules/fuel/controllers/Login.php
- 7.5CVE-2021-22003EPSS 1.0%
VMware Workspace ONE Access and Identity Manager, unintentionally provide a login interface on port 7443. A malicious actor with network access to port 7443 may attempt user enumeration or brute force the login endpoint, which may or may n…
- 6.5CVE-2021-29987EPSS 0.9%
After requesting multiple permissions, and closing the first permission panel, subsequent permission panels will be displayed in a different position but still record a click in the default location, making it possible to trick a user into…
- 9.8CVE-2020-18698EPSS 2.0%
Improper Authentication in Lin-CMS-Flask v0.1.1 allows remote attackers to launch brute force login attempts without restriction via the 'login' function in the component 'app/api/cms/user.py'.
- 7.5CVE-2021-20427EPSS 1.3%
IBM Security Guardium 11.2 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 196314.
- 7.5CVE-2021-38155EPSS 2.5%
OpenStack Keystone 10.x through 16.x before 16.0.2, 17.x before 17.0.1, 18.x before 18.0.1, and 19.x before 19.0.1 allows information disclosure during account locking (related to PCI DSS features). By guessing the name of an account and f…
- 7.5CVE-2021-27943EPSS 0.9%
The pairing procedure used by the Vizio P65-F1 6.0.31.4-2 and E50x-E1 10.0.31.4-2 Smart TVs and mobile application is vulnerable to a brute-force attack (against only 10000 possibilities), allowing a threat actor to forcefully pair the dev…
- 8.8CVE-2021-35472EPSS 1.8%
An issue was discovered in LemonLDAP::NG before 2.0.12. Session cache corruption can lead to authorization bypass or spoofing. By running a loop that makes many authentication attempts, an attacker might alternately be authenticated as one…
- 7.5CVE-2021-3663EPSS 0.7%
firefly-iii is vulnerable to Improper Restriction of Excessive Authentication Attempts
- 7.5CVE-2020-23283EPSS 1.4%
Information disclosure in Logon Page in MV's mConnect application v02.001.00 allows an attacker to know valid users from the application's database via brute force.
- 7.5CVE-2021-32705EPSS 1.7%
Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, there was a lack of ratelimiting on the public DAV endpoint. This may have allowed an attacker to enumerate potentially va…
- 5.3CVE-2021-32703EPSS 1.5%
Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, there was a lack of ratelimiting on the shareinfo endpoint. This may have allowed an attacker to enumerate potentially val…
- 5.3CVE-2021-32678EPSS 1.4%
Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.0.11, and 21.0.3, ratelimits are not applied to OCS API responses. This affects any OCS API controller (`OCSController`) using the `@BruteF…
- 7.5CVE-2021-20415EPSS 0.9%
IBM Guardium Data Encryption (GDE) 4.0.0.4 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 196217.
- 9.8CVE-2021-32522EPSS 1.4%
Improper restriction of excessive authentication attempts vulnerability in QSAN Storage Manager, XEVO, SANOS allows remote attackers to discover users’ credentials and obtain access via a brute force attack. Suggest contacting with QSAN an…
- 7.5CVE-2021-28127EPSS 0.9%
An issue was discovered in Stormshield SNS through 4.2.1. A brute-force attack can occur.
- 9.8CVE-2021-22915EPSS 1.7%
Nextcloud server before 19.0.11, 20.0.10, 21.0.2 is vulnerable to brute force attacks due to lack of inclusion of IPv6 subnets in rate-limiting considerations. This could potentially result in an attacker bypassing rate-limit controls such…
- 5.3CVE-2021-33190EPSS 2.7%
In Apache APISIX Dashboard version 2.6, we changed the default value of listen host to 0.0.0.0 in order to facilitate users to configure external network access. In the IP allowed list restriction, a risky function was used for the IP acqu…
- 7.3CVE-2021-3412EPSS 0.8%
It was found that all versions of 3Scale developer portal lacked brute force protections. An attacker could use this gap to bypass login controls, and access privileged information, or possibly conduct further attacks.
- 9.8CVE-2021-22737EPSS 0.9%
Insufficiently Protected Credentials vulnerability exists in homeLYnk (Wiser For KNX) and spaceLYnk V2.60 and prior that could cause unauthorized access of when credentials are discovered after a brute force attack.
- 7.5CVE-2020-26556EPSS 0.9%
Mesh Provisioning in the Bluetooth Mesh profile 1.0 and 1.0.1 may permit a nearby device, able to conduct a successful brute-force attack on an insufficiently random AuthValue before the provisioning procedure times out, to complete authen…
- 5.3CVE-2021-29023EPSS 1.2%
InvoicePlane 1.5.11 doesn't have any rate-limiting for password reset and the reset token is generated using a weak mechanism that is predictable.
- 9.8CVE-2021-31646EPSS 1.3%
Gestsup before 3.2.10 allows account takeover through the password recovery functionality (remote). The affected component is the file forgot_pwd.php - it uses a weak algorithm for the generation of password recovery tokens (the PHP unique…
- 5.5CVE-2021-29648EPSS 0.3%
An issue was discovered in the Linux kernel before 5.11.11. The BPF subsystem does not properly consider that resolved_ids and resolved_sizes are intentionally uninitialized in the vmlinux BPF Type Format (BTF), which can cause a system cr…
- 7.5CVE-2021-28248EPSS 1.4%
CA eHealth Performance Manager through 6.3.2.12 is affected by Improper Restriction of Excessive Authentication Attempts. An attacker is able to perform an arbitrary number of /web/frames/ authentication attempts using different passwords,…
- 9.8CVE-2019-18235EPSS 1.5%
Advantech Spectre RT ERT351 Versions 5.1.3 and prior has insufficient login authentication parameters required for the web application may allow an attacker to gain full access using a brute-force password attack.
- 5.5CVE-2020-4891EPSS 0.3%
IBM Spectrum Scale 5.0.0 through 5.0.5.5 and 5.1.0 through 5.1.0.2 uses an inadequate account lockout setting that could allow a local user er to brute force Rest API account credentials. IBM X-Force ID: 190974.
- 7.5CVE-2021-25676EPSS 1.3%
A vulnerability has been identified in RUGGEDCOM RM1224 (V6.3), SCALANCE M-800 (V6.3), SCALANCE S615 (V6.3), SCALANCE SC-600 (All Versions >= V2.1 and < V2.1.3). Multiple failed SSH authentication attempts could trigger a temporary Denial-…
- 9.8CVE-2021-25309EPSS 1.4%
The telnet administrator service running on port 650 on Gigaset DX600A v41.00-175 devices does not implement any lockout or throttling functionality. This situation (together with the weak password policy that forces a 4-digit password) al…
- 9.8CVE-2021-27514EPSS 3.5%
EyesOfNetwork 5.3-10 uses an integer of between 8 and 10 digits for the session ID, which might be leveraged for brute-force authentication bypass (such as in CVE-2021-27513 exploitation).
- 9.8CVE-2020-35565EPSS 1.1%
An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. The login pages bruteforce detection is disabled by default.
- 7.5CVE-2021-27188EPSS 1.8%
The Sovremennye Delovye Tekhnologii FX Aggregator terminal client 1 allows attackers to cause a denial of service (access suspended for five hours) by making five invalid login attempts to a victim's account.
- 6.5CVE-2021-20635EPSS 0.4%
Improper restriction of excessive authentication attempts in LOGITEC LAN-WH450N/GR allows an attacker in the wireless range of the device to recover PIN and access the network.
- 7.5CVE-2021-3138EPSS 3.1%
In Discourse 2.7.0 through beta1, a rate-limit bypass leads to a bypass of the 2FA requirement for certain forms.
- 5.4CVE-2021-1311EPSS 1.3%
A vulnerability in the reclaim host role feature of Cisco Webex Meetings and Cisco Webex Meetings Server could allow an authenticated, remote attacker to take over the host role during a meeting. This vulnerability is due to a lack of prot…
- 7.5CVE-2020-35586EPSS 1.4%
In Solstice Pod before 3.3.0 (or Open4.3), the Administrator password can be enumerated using brute-force attacks via the /Config/service/initModel?password= Solstice Open Control API because there is no complexity requirement (e.g., it mi…
- 7.5CVE-2020-35585EPSS 1.4%
In Solstice Pod before 3.3.0 (or Open4.3), the screen key can be enumerated using brute-force attacks via the /lookin/info Solstice Open Control API because there are only 1.7 million possibilities.