CWE-307: Improper Restriction of Excessive Authentication Attempts

Base Draft Simple

CWE版本: 4.18

更新日期: 2025-09-09

弱点描述

The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.

常见后果

影响范围: Access Control

技术影响: Bypass Protection Mechanism

说明: An attacker could perform an arbitrary number of authentication attempts using different passwords, and eventually gain access to the targeted account using a brute force attack.

潜在缓解措施

阶段: Architecture and Design

策略: Libraries or Frameworks

检测方法

方法: Dynamic Analysis with Automated Results Interpretation

有效性: High

方法: Dynamic Analysis with Manual Results Interpretation

有效性: High

方法: Manual Static Analysis - Source Code

有效性: High

方法: Automated Static Analysis - Source Code

有效性: SOAR Partial

方法: Automated Static Analysis

有效性: SOAR Partial

方法: Architecture or Design Review

有效性: High

观察示例

参考: CVE-2019-0039

the REST API for a network OS has a high limit for number of connections, allowing brute force password guessing

参考: CVE-1999-1152