CWE-307 Improper Restriction of Excessive Authentication Attempts
baseThe product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.
01
parent weaknesses
Broader classes this is a kind of.
02
vulnerabilities (826)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2019-17240US | critical9.8 | Exploit | ||
bl-kernel/security.class.php in Bludit 3.9.2 allows attackers to bypass a brute-force protection mechanism by using many different forged X-Forwarded-For or Client-IP HTTP headers. | ||||
| CVE-2020-15906US | critical9.8 | Exploit | ||
tiki-login.php in Tiki before 21.2 sets the admin password to a blank value after 50 invalid login attempts. | ||||
| CVE-2016-9361US | critical9.8 | Exploit | ||
An issue was discovered in Moxa NPort 5110 versions prior to 2.6, NPort 5130/5150 Series versions prior to 3.6, NPort 5200 Series versions prior to 2.8, NPort 5400 Series versions… | ||||
| CVE-2003-1096US | high10.0 | Exploit | ||
The Cisco LEAP challenge/response authentication mechanism uses passwords in a way that is susceptible to dictionary attacks, which makes it easier for remote attackers to gain pri… | ||||
| CVE-2023-27100US | critical9.8 | Exploit | ||
Improper restriction of excessive authentication attempts in the SSHGuard component of Netgate pfSense Plus software v22.05.1 and pfSense CE software v2.6.0 allows attackers to byp… | ||||
| CVE-2001-1291US | critical9.8 | Exploit | ||
The telnet server for 3Com hardware such as PS40 SuperStack II does not delay or disconnect remote attackers who provide an incorrect username or password, which makes it easier to… | ||||
| CVE-2001-1339US | critical9.8 | Exploit | ||
Beck IPC GmbH IPC@CHIP telnet service does not delay or disconnect users from the service when bad passwords are entered, which makes it easier for remote attackers to conduct brut… | ||||
| CVE-2022-30600US | critical9.8 | Exploit | ||
A flaw was found in moodle where logic used to count failed login attempts could result in the account lockout threshold being bypassed. | ||||
| CVE-2020-35590US | critical9.8 | Exploit | ||
LimitLoginAttempts.php in the limit-login-attempts-reloaded plugin before 2.17.4 for WordPress allows a bypass of (per IP address) rate limits because the X-Forwarded-For header ca… | ||||
| CVE-2005-4145US | medium6.5 | Exploit | ||
The MSDE version of Lyris ListManager 5.0 through 8.9b configures the sa account in the database to use a password with a small search space ("lyris" and up to 5 digits, possibly f… | ||||
| CVE-2026-44596US | critical9.8 | Exploit | ||
Yamcs is a mission control framework. Prior to 5.12.7, the authentication endpoint POST /auth/token in yamcs-core, handled by yamcs-core/src/main/java/org/yamcs/http/auth/AuthHandl… | ||||
| CVE-2023-27746US | critical9.8 | Exploit | ||
BlackVue DR750-2CH LTE v.1.012_2022.10.26 was discovered to contain a weak default passphrase which can be easily cracked via a brute force attack if the WPA2 handshake is intercep… | ||||
| CVE-2023-22960US | high7.5 | Exploit | ||
Lexmark products through 2023-01-10 have Improper Control of Interaction Frequency. | ||||
| CVE-2020-15367US | critical9.8 | Exploit | ||
Venki Supravizio BPM 10.1.2 does not limit the number of authentication attempts. An unauthenticated user may exploit this vulnerability to launch a brute-force authentication atta… | ||||
| CVE-2026-43914US | critical9.8 | Exploit | ||
Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.35.4, there is a security vulnerability in Vaultwarden that allows bypassing the login brute-force protecti… | ||||
| CVE-2023-49792US | critical9.8 | Exploit | ||
Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. In Nextcloud Server prior to versions 26.0.9 and 27.1.4; as well as Nextcloud Enterprise Server… | ||||
| CVE-2023-37635US | critical9.8 | Exploit | ||
UVDesk Community Skeleton v1.1.1 allows unauthenticated attackers to perform brute force attacks on the login page to gain access to the application. | ||||
| CVE-2023-1665US | critical9.8 | Exploit | ||
Improper Restriction of Excessive Authentication Attempts in GitHub repository linagora/twake prior to 0.0.0. | ||||
| CVE-2021-36750US | high8.1 | Exploit | ||
ENC DataVault before 7.2 and VaultAPI v67 mishandle key derivation, making it easier for attackers to determine the passwords of all DataVault users (across USB drives sold under m… | ||||
| CVE-2019-17525US | high8.8 | Exploit | ||
The login page on D-Link DIR-615 T1 20.10 devices allows remote attackers to bypass the CAPTCHA protection mechanism and conduct brute-force attacks. | ||||
03
attack patterns (7)
CAPEC attack patterns that exploit this.
04
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan