| शीर्षक | saleor <=3.23.14 Improper Restriction of Excessive Authentication Attempts |
|---|
| विवरण | this is an exploit chain via two vulns, it allows attacker to launch brute force attacks.
VULN-002: User enumeration via distinct account-status error codes (tokenCreate)
VULN-001: Login throttle bypass via spoofable X-Forwarded-For (get_client_ip) |
|---|
| स्रोत | ⚠️ https://github.com/zast-ai/vulnerability-reports/blob/main/saleor/bruteforce.md |
|---|
| उपयोगकर्ता | ZAST.AI (UID 87884) |
|---|
| सबमिशन | 17/08/2026 05:49 AM (1 महीना पहले) |
|---|
| संयम | 18/09/2026 03:08 PM (1 month later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 407477 [Saleor तक 3.20.118/3.21.54/3.22.47/3.23.14 throttling.py get_client_ip सूचना का प्रकटीकरण] |
|---|
| अंक | 18 |
|---|