Описание
This vulnerability exists in the Wave 2.0 due to missing rate limiting on OTP requests in an API endpoint. An authenticated remote attacker could exploit this vulnerability by sending multiple OTP request through vulnerable API endpoint which could lead to the OTP bombing/flooding on the targeted system.
Ссылки
- Third Party Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 120820241550 (исключая)Версия до 1.1.7 (исключая)
Одно из
cpe:2.3:a:63moons:aero:*:*:*:*:*:*:*:*
cpe:2.3:a:63moons:wave_2.0:*:*:*:*:*:*:*:*
EPSS
Процентиль: 79%
0.01232
Низкий
6.5 Medium
CVSS3
Дефекты
CWE-799
CWE-770
Связанные уязвимости
CVSS3: 6.5
github
больше 1 года назад
This vulnerability exists in the Wave 2.0 due to missing rate limiting on OTP requests in an API endpoint. An authenticated remote attacker could exploit this vulnerability by sending multiple OTP request through vulnerable API endpoint which could lead to the OTP bombing/flooding on the targeted system.
EPSS
Процентиль: 79%
0.01232
Низкий
6.5 Medium
CVSS3
Дефекты
CWE-799
CWE-770