Infrastructure · Code · first seen 3 Oct · CWE-307
MediumLikelyOpenPlatformfix by 2 Dec
Open · Platform's
It's Platform's, but no one has picked it up.
One problem in one place, found by code.
1 source · 1 place
Code
kratos/no-login-throttle · commit 88f20ce by a
What closes it
Nobody can mark it fixed by hand. A person submits the fix; a scan or a retest decides it.
32nd of 39 in your queue
Proof first, then exploitation in the wild, a public exploit, EPSS and severity, adjusted for exposure and how much the asset matters
Priority
36 / 100
What each source saw
As each source gives it · secrets, keys and card numbers stay masked
The code · tessellate/auth-service
Open the repositoryconfig/kratos.yml
| 54 | selfservice: |
| 55 | flows: |
| 56 | login: |
| 57 | lifespan: 1h |
| 58 | # no rate limit or lockout configured |
Opens auth.tessellatepay.com to the internet
Our scan sent 120 sign-in requests in 9.4s and every one was answered.
See the hostThe fix
Turn on Kratos' login rate limiting, or add a Cloudflare rule on /self-service/login.
What happened, and what was said
1 event · 0 comments · oldest first
One finding belongs with this one
The same story from another source: fix them together