CVE-2021-41171

Katalog CVE

CVSS 8.8 · High EPSS 1,9%

Kerentanan Improper Restriction of Excessive Authentication Attempts pada elabftw. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

eLabFTW is an open source electronic lab notebook manager for research teams. In versions of eLabFTW before 4.1.0, it allows attackers to bypass a brute-force protection mechanism by using many different forged PHPSESSID values in HTTP Cookie header. This issue has been addressed by implementing brute force login protection, as recommended by Owasp with Device Cookies. This mechanism will not impact users and will effectively thwart any brute-force attempts at guessing passwords. The only correct way to address this is to upgrade to version 4.1.0. Adding rate limitation upstream of the eLabFTW service is of course a valid option, with or without upgrading.

Rincian

Terbit di NVD

22 Oktober 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-307: Improper Restriction of Excessive Authentication Attempts

EPSS (30 hari)

1,9% peluang dieksploitasi; lebih tinggi dari 79,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/elabftw/elabftw/commit/8e92afeec4c3a68dc88333881b7e6307f425706b patch · advisory pihak ketiga
• https://github.com/elabftw/elabftw/releases/tag/4.1.0 release notes · advisory pihak ketiga
• https://github.com/elabftw/elabftw/security/advisories/GHSA-q67h-5pc3-g6jv advisory pihak ketiga
• https://owasp.org/www-community/Slow_Down_Online_Guessing_Attacks_with_Device_Cookies advisory pihak ketiga
• https://www.exploit-db.com/docs/50436 exploit · advisory pihak ketiga · vdb entry