PT-2014-8785 · Monstra · Monstra

Publicado 2014-11-20 · Atualizado 2017-09-08 · CVE-2014-9006

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Monstra versions 3.0.1 and earlier

Description The issue allows remote attackers to conduct brute force login attacks. This is possible because Monstra uses a cookie to track the number of login attempts, and an attacker can manipulate this by deleting the login attempts cookie or setting it to specific values.

Recommendations For Monstra versions 3.0.1 and earlier, consider implementing additional security measures to prevent brute force login attacks, such as restricting access to the login functionality after a certain number of failed attempts or using a more secure method to track login attempts. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Correção

Enumeração de Fraquezas

CWE-255

Identificadores relacionados

CVE-2014-9006

Produtos afetados

Monstra

Referências · 3

• 🔥 http://packetstormsecurity.com/files/129082/Monstra-3.0.1-Bruteforce-Mitigation-Bypass.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-9006 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/98649 · Nota