wwbn/avideo · Security
WWBN AVideo Improper Restriction of Excessive Authentication Attempts vulnerability
- GHSA ID
- GHSA-v977-h4hm-rrff
- CVE ID
- CVE-2023-49810
- Severity
- high
- Published
- Updated
- CVSS
- 7.3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
- CVSS v3
- 7.3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Description
A login attempt restriction bypass vulnerability exists in the checkLoginAttempts functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to captcha bypass, which can be abused by an attacker to bruteforce users credentials. An attacker can send a series of HTTP requests to trigger this vulnerability.
CWEs
- CWE-307 · Improper Restriction of Excessive Authentication Attempts