PT-2024-39029 · Windmill · Windmill

Deepcove · Published 2024-09-05 · Updated 2024-09-06 · CVE-2024-8462

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions: Windmill version 1.380.0

Description: A vulnerability exists in the HTTP Request Handler component, affecting an unknown function of the file backend/windmill-api/src/users.rs. This issue leads to improper restriction of excessive authentication attempts, allowing remote attacks. The complexity of an attack is rather high, and the exploitability is difficult.

Recommendations: For Windmill version 1.380.0, upgrade to version 1.390.1 to address this issue. As a temporary workaround, consider restricting access to the users.rs file or the affected HTTP Request Handler component to minimize the risk of exploitation.

Fix

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-307

Related Identifiers

CVE-2024-8462

GHSA-G6Q4-W3J3-JFC4

GO-2024-3118

Affected Products

Windmill

References · 14

• https://github.com/windmill-labs/windmill/commit/acfe7786152f036f2476f93ab5536571514fa9e3 · Patch
• https://github.com/windmill-labs/windmill/releases/tag/v1.390.1 · Patch
• https://osv.dev/vulnerability/GHSA-g6q4-w3j3-jfc4 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-8462 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2024-3118 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-8462 · Security Note
• https://github.com/windmill-labs/windmill · Note
• https://twitter.com/CVEnew/status/1831684917895299553 · Twitter Post
• https://pkg.go.dev/vuln/GO-2024-3118 · Note
• https://vuldb.com/?ctiid.276630 · Note
• https://vuldb.com/?submit.401826 · Note
• https://vuldb.com/?id.276630 · Note
• https://twitter.com/VulmonFeeds/status/1831700685437514062 · Twitter Post
• https://t.me/cvedetector/4913 · Telegram Post