| タイトル | VictoriaMetrics <=1.146.0 Improper Restriction of Excessive Authentication Attempts |
|---|
| 説明 | The VMAuth (<=1.146.0) authentication endpoint lacks a brute-force protection mechanism, has no limit on login failure attempts, no account locking, and no CAPTCHA. Attackers can attempt to guess the credentials without limit. This vulnerability was verified with python POC in the vulnerability report: https://github.com/VictoriaMetrics/VictoriaMetrics/issues/11180 |
|---|
| ソース | ⚠️ https://github.com/VictoriaMetrics/VictoriaMetrics/issues/11180 |
|---|
| ユーザー | ZAST.AI (UID 87884) |
|---|
| 送信 | 2026年06月26日 10:51 (2 月 ago) |
|---|
| モデレーション | 2026年08月14日 21:02 (2 months later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 390088 [VictoriaMetrics 迄 1.146.0 VMAuth Authentication Endpoint app/vmauth/main.go requestHandler 情報漏えい] |
|---|
| ポイント | 19 |
|---|