CVE-2022-2166

EUVD-2022-34451
Improper Restriction of Excessive Authentication Attempts in GitHub repository mastodon/mastodon prior to 4.0.0.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
@huntrdevCNA
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 79%
Affected Products (NVD)
VendorProductVersion
joinmastodonmastodon
𝑥
≤ 3.5.5
joinmastodonmastodon
4.0.0:rc1
joinmastodonmastodon
4.0.0:rc2
joinmastodonmastodon
4.0.0:rc3
joinmastodonmastodon
4.0.0:rc4
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/mastodon/mastodon/commit/21fd25a269cca742af431f0d13299e139f267346
https://huntr.dev/bounties/2f96f990-01c2-44ea-ae47-58bdb3aa455b
https://github.com/mastodon/mastodon/commit/21fd25a269cca742af431f0d13299e139f267346
https://huntr.dev/bounties/2f96f990-01c2-44ea-ae47-58bdb3aa455b