Skip to main content

Improper Restriction of Excessive Authentication Attempts

CVE-2024-8462

Low
3.7/10

Summary

A vulnerability was found in Windmill versions prior to 1.390.1. It has been classified as problematic. Affected is an unknown function of the file "backend/windmill-api/src/users.rs" of the component HTTP Request Handler. The manipulation leads to improper restriction of excessive authentication attempts. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is said to be difficult. It is recommended to upgrade the affected component.

  • HIGH
  • NETWORK
  • NONE
  • UNCHANGED
  • NONE
  • NONE
  • LOW
  • NONE

CWE-307 - Improper Restriction of Excessive Authentication Attempts

The software does not implement sufficient measures to prevent multiple failed authentication attempts within in a short time frame, making it more susceptible to brute force attacks.

References

Advisory Timeline

  • Published