GitHub Advisoryadvisory · PyPI

GHSA-9g3v-v24q-jj5p rdiffweb does not have a rate limit on incorrect password attempts to prevent brute force attacks

HIGH Published 2022-10-06 Modified 2024-11-22 Official page ↗
Aliases
CVE-2022-3273
Ecosystem
PyPI
Packages
rdiffweb
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-326, CWE-770
Reviewed
2022-10-06

Affected packages

• PyPI rdiffweb: < 2.5.0 → fixed in 2.5.0

Description

rdiffweb prior to 2.5.0a4 does not have a rate limit to prevent attackers attempting brute force attacks to guess passwords. Version 2.5.0a4 limits the number of incorrect password attempts.

Related

Alias · CVE (1)

  • CVE-2022-3273 Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.0a4. vulnerability

Weakness · CWE (2)

  • CWE-326 Inadequate Encryption Strength weakness
  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References