Описание
Vikunja before 2.6.0 contains an authentication bypass vulnerability in CalDAV BasicAuth endpoints that lack rate limiting protection. Remote unauthenticated attackers can issue unbounded credential-guessing requests against /dav, /.well-known, and /feeds routes to bypass the instance's anti-brute-force controls and compromise password-only accounts.
EPSS
Процентиль: 48%
0.00609
Низкий
7.5 High
CVSS3
Дефекты
CWE-307
Связанные уязвимости
CVSS3: 7.5
github
3 дня назад
Vikunja before 2.6.0 contains an authentication bypass vulnerability in CalDAV BasicAuth endpoints that lack rate limiting protection. Remote unauthenticated attackers can issue unbounded credential-guessing requests against /dav, /.well-known, and /feeds routes to bypass the instance's anti-brute-force controls and compromise password-only accounts.
EPSS
Процентиль: 48%
0.00609
Низкий
7.5 High
CVSS3
Дефекты
CWE-307