Vulnerability Details : CVE-2022-2650
Improper Restriction of Excessive Authentication Attempts in GitHub repository wger-project/wger prior to 2.2.
Products affected by CVE-2022-2650
- cpe:2.3:a:wger:wger:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2022-2650
0.19%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 57 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2022-2650
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
7.8
|
HIGH | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
1.8
|
5.9
|
huntr.dev | |
|
9.8
|
CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
3.9
|
5.9
|
NIST |
CWE ids for CVE-2022-2650
-
The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks.Assigned by:
- nvd@nist.gov (Primary)
- security@huntr.dev (Secondary)
References for CVE-2022-2650
-
https://github.com/wger-project/wger/commit/5e3167e3a2dc95836fa2607fe201524c031a2c4c
Merge branch 'master' into add-django-axes · wger-project/wger@5e3167e · GitHubPatch;Third Party Advisory
-
https://huntr.dev/bounties/f0d85efa-4e78-4b1d-848f-edea115af64b
No Protection against Bruteforce attacks on Login page vulnerability found in wgerExploit;Third Party Advisory
Jump to