CVE-2023-49810

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-49810
A login attempt restriction bypass vulnerability exists in the checkLoginAttempts functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to captcha bypass, which can be abused by an attacker to brute force user credentials. An attacker can send a series of HTTP requests to trigger this vulnerability.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://talosintelligence.com/vulnerability_reports/TALOS-2023-1898 Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:wwbn:avideo:15fed957fb:*:*:*:*:*:*:*
History

17 Jan 2024, 15:07

Type Values Removed Values Added
CPE cpe:2.3:a:wwbn:avideo:15fed957fb:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : 7.3 		v2 : unknown
v3 : 6.5
References () https://talosintelligence.com/vulnerability_reports/TALOS-2023-1898 - () https://talosintelligence.com/vulnerability_reports/TALOS-2023-1898 - Exploit, Third Party Advisory
First Time Wwbn avideo
Wwbn

12 Jan 2024, 19:15

Type Values Removed Values Added
Summary (en) A login attempt restriction bypass vulnerability exists in the checkLoginAttempts functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to captcha bypass, which can be abused by an attacker to bruteforce users credentials. An attacker can send a series of HTTP requests to trigger this vulnerability. (en) A login attempt restriction bypass vulnerability exists in the checkLoginAttempts functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to captcha bypass, which can be abused by an attacker to brute force user credentials. An attacker can send a series of HTTP requests to trigger this vulnerability.

10 Jan 2024, 18:15

Type Values Removed Values Added
References
  • {'url': 'https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1898', 'source': 'talos-cna@cisco.com'}
Summary
  • (es) Existe una vulnerabilidad de omisión de restricción de intento de inicio de sesión en la funcionalidad checkLoginAttempts de la confirmación maestra de desarrollo de WWBN AVideo 15fed957fb. Una solicitud HTTP especialmente manipulada puede provocar la omisión de captcha, que un atacante puede aprovechar para aplicar fuerza bruta a las credenciales de los usuarios. Un atacante puede enviar una serie de solicitudes HTTP para desencadenar esta vulnerabilidad.

10 Jan 2024, 16:59

Type Values Removed Values Added
New CVE
Information

Published : 2024-01-10 16:15

Updated : 2024-01-17 15:07

NVD link : CVE-2023-49810

Mitre link : CVE-2023-49810

CVE.ORG link : CVE-2023-49810

JSON object : View

Products Affected

wwbn

  • avideo
CWE
CWE-307

Improper Restriction of Excessive Authentication Attempts