Vulnerabilities > CVE-2018-12649 - Improper Restriction of Excessive Authentication Attempts vulnerability in Misp 2.4.92

047910
CVSS 9.8 - CRITICAL
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
HIGH
Integrity impact
HIGH
Availability impact
HIGH
network
low complexity
misp
CWE-307
critical
NVD
Published: 2018-06-22
Updated: 2019-10-03

Summary

An issue was discovered in app/Controller/UsersController.php in MISP 2.4.92. An adversary can bypass the brute-force protection by using a PUT HTTP method instead of a POST HTTP method in the login part, because this protection was only covering POST requests.

Vulnerable Configurations

Part Description Count
Application
Misp
1

Common Weakness Enumeration (CWE)

References