Lucene search

Https://gitlab.com/gitlab-org/security-products/gemnasium-dbGITLAB-FD21AE02D7B236CEAB236DD64E7A45CC

HistoryApr 10, 2023 - 12:00 a.m.

Improper Restriction of Excessive Authentication Attempts

2023-04-1000:00:00

https://gitlab.com/gitlab-org/security-products/gemnasium-db

gitlab.com

improper restriction

excessive authentication attempts

rate limiting

brute-force

user credentials

flask-appbuilder

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.002

Percentile

52.3%

JSON

Flask-AppBuilder versions before 4.3.0 lack rate limiting which can allow an attacker to brute-force user credentials. Version 4.3.0 includes the ability to enable rate limiting using AUTH_RATE_LIMITED = True, RATELIMIT_ENABLED = True, and setting an AUTH_RATE_LIMIT.