PT-2014-8785 · Monstra · Monstra

Published 2014-11-20 · Updated 2017-09-08 · CVE-2014-9006

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Monstra versions 3.0.1 and earlier

Description The issue allows remote attackers to conduct brute force login attacks. This is possible because Monstra uses a cookie to track the number of login attempts, and an attacker can manipulate this by deleting the login attempts cookie or setting it to specific values.

Recommendations For Monstra versions 3.0.1 and earlier, consider implementing additional security measures to prevent brute force login attacks, such as restricting access to the login functionality after a certain number of failed attempts or using a more secure method to track login attempts. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Weakness Enumeration

CWE-255

Related Identifiers

CVE-2014-9006

Affected Products

Monstra

References · 3

• 🔥 http://packetstormsecurity.com/files/129082/Monstra-3.0.1-Bruteforce-Mitigation-Bypass.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-9006 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/98649 · Note