Lucene search
+L

1 matches found

Hacker One
Hacker One
added 2017/09/18 7:37 p.m.30 views

Moneybird: Bypass of Rate limiting in secure_session endpoint's password input will lead to user password disclosure

The rate limit for entering a password to start a secure session was too low. This allowed for brute force password guessing when an attacker would gain access to an existing session of a user. We have solved the issue by making the password rate limit the same as the regular login procedure...

1.5AI score
SaveExploits0
Rows per page
Query Builder