CWE-307Improper Restriction of Excessive Authentication Attempts

Description

The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.

Common consequences

• Access Control→Bypass Protection Mechanism
  An attacker could perform an arbitrary number of authentication attempts using different passwords, and eventually gain access to the targeted account using a brute force attack.

Potential mitigations

• Architecture and Design
  [object Object]
• Architecture and Design
  [object Object]

Related CWEs

Recent CVEs classified under this CWE