CVE-2024-57610
HIGHSylius v2.0.2 - Unrestricted Brute-Force Attack via Missing Rate Limiting
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2024-57610. PoCs published by Mr-UN533N, str4ng3r-0x7.
AI-analyzed exploit summary The repository lacks actual exploit code and instead provides vague steps to reproduce a rate-limiting issue, along with external links to a video and image. No technical details or code are included.
Description
A rate limiting issue in Sylius v2.0.2 allows a remote attacker to perform unrestricted brute-force attacks on user accounts, significantly increasing the risk of account compromise and denial of service for legitimate users. The Supplier's position is that the Sylius core software is not intended to address brute-force attacks; instead, customers deploying a Sylius-based system are supposed to use "firewalls, rate-limiting middleware, or authentication providers" for that functionality.
Exploits (2)
The repository lacks actual exploit code and instead provides vague steps to reproduce a rate-limiting issue, along with external links to a video and image. No technical details or code are included.
This repository describes a lack of rate limiting in Sylius v2.0.2, allowing unrestricted login attempts. The PoC involves automated login requests without any rate-limiting restrictions.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H