Defences · Scan · first seen 1 Oct
MediumLikelyOpenKelvin Obisesanfix by 30 Nov
Open · with Kelvin
Nothing's blocking it. It closes when the check that found it stops seeing it.
One problem in four places, found by scan.
2 sources · 4 places
Scan
First found Thu 1 Oct, last seen Mon 12 Oct
First found Thu 1 Oct, last seen Thu 15 Oct
What closes it
Nobody can mark it fixed by hand. A person submits the fix; a scan or a retest decides it.
31st of 39 in your queue
Proof first, then exploitation in the wild, a public exploit, EPSS and severity, adjusted for exposure and how much the asset matters
Priority
36 / 100
What each source saw
As each source gives it · secrets, keys and card numbers stay masked
The scan's case file · tessellatepay.com
See it in that scanWhy it matters here
Sign-in and session endpoints answered all 120 requests in under ten seconds. Password guessing and card testing go unchecked.
What we saw, on 3 hosts
120 requests to /api/auth/login in 9.4s, every one answered. Nothing slowed or stopped them.
The fix
Add a rate limit at Cloudflare (a rule on /api/auth/* and /self-service/*), or in the app.
Where
What happened, and what was said
1 event · 0 comments · oldest first
One finding belongs with this one
The same story from another source: fix them together