Vulnerabilities > CVE-2020-15906 - Improper Restriction of Excessive Authentication Attempts vulnerability in Tiki
Attack vector
NETWORK Attack complexity
LOW Privileges required
NONE Confidentiality impact
HIGH Integrity impact
HIGH Availability impact
HIGH Summary
tiki-login.php in Tiki before 21.2 sets the admin password to a blank value after 50 invalid login attempts.
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| Application | 15 |
Common Weakness Enumeration (CWE)
References
- http://packetstormsecurity.com/files/159663/Tiki-Wiki-CMS-Groupware-21.1-Authentication-Bypass.html
- http://packetstormsecurity.com/files/159663/Tiki-Wiki-CMS-Groupware-21.1-Authentication-Bypass.html
- https://info.tiki.org/article473-Security-Releases-of-all-Tiki-versions-since-16-3
- https://info.tiki.org/article473-Security-Releases-of-all-Tiki-versions-since-16-3