PT-2025-5850 · Sylius · Sylius

Published 2025-02-06 · Updated 2025-02-06 · CVE-2024-57610

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Sylius version 2.0.2

Description A rate limiting issue allows a remote attacker to perform unrestricted brute-force attacks on user accounts, significantly increasing the risk of account compromise and denial of service for legitimate users. The supplier's position is that the Sylius core software is not intended to address brute-force attacks; instead, customers deploying a Sylius-based system are supposed to use firewalls, rate-limiting middleware, or authentication providers for that functionality.

Recommendations For Sylius version 2.0.2, consider using firewalls, rate-limiting middleware, or authentication providers to mitigate the risk of brute-force attacks, as the Sylius core software does not address this functionality.

Exploit

Fix

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-307

Related Identifiers

CVE-2024-57610

GHSA-2HJH-495W-HMXC

Affected Products

Sylius

References · 9

• 🔥 https://github.com/nca785/CVE-2024-57610 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-57610 · Security Note
• https://osv.dev/vulnerability/CVE-2024-57610 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2hjh-495w-hmxc · Vendor Advisory
• https://github.com/Sylius/Sylius · Note
• https://github.com/github/advisory-database/pull/5254 · Note
• https://t.me/cvedetector/17397 · Telegram Post
• https://sylius.com · Note
• https://twitter.com/CVEnew/status/1887566535281258567 · Twitter Post