CVE-2020-11052

In Sorcery before 0.15.0, there is a brute force vulnerability when using password authentication via Sorcery. The brute force protection submodule will prevent a brute force attack for the defined lockout period, but once expired, protection will not be re-enabled until a user or malicious actor logs in successfully. This does not affect users that do not use the built-in brute force protection submodule, nor users that use permanent account lockout. This has been patched in 0.15.0.

CVSS v3 8.3 HIGH
CVSS v2.0 5.0 MEDIUM

8.3^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope CHANGED

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://github.com/Sorcery/sorcery/commit/0f116d223826895a73b12492f17486e5d54ab7a7	Patch Third Party Advisory
https://github.com/Sorcery/sorcery/issues/231	Third Party Advisory
https://github.com/Sorcery/sorcery/pull/235	Patch Third Party Advisory
https://github.com/Sorcery/sorcery/security/advisories/GHSA-jc8m-cxhj-668x	Third Party Advisory
https://github.com/Sorcery/sorcery/commit/0f116d223826895a73b12492f17486e5d54ab7a7	Patch Third Party Advisory
https://github.com/Sorcery/sorcery/issues/231	Third Party Advisory
https://github.com/Sorcery/sorcery/pull/235	Patch Third Party Advisory
https://github.com/Sorcery/sorcery/security/advisories/GHSA-jc8m-cxhj-668x	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:sorcery_project:sorcery:*:*:*:*:*:ruby:*:*

History

No history.

Information

Published : 2020-05-07 21:15

Updated : 2024-11-21 04:56

NVD link : CVE-2020-11052

Mitre link : CVE-2020-11052

CVE.ORG link : CVE-2020-11052

JSON object : View

Products Affected

sorcery_project

sorcery

CWE

CWE-307

Improper Restriction of Excessive Authentication Attempts

{"id": "CVE-2020-11052", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 3.7, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2020-05-07T21:15:11.483", "references": [{"url": "https://github.com/Sorcery/sorcery/commit/0f116d223826895a73b12492f17486e5d54ab7a7", "tags": ["Patch", "Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/Sorcery/sorcery/issues/231", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/Sorcery/sorcery/pull/235", "tags": ["Patch", "Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/Sorcery/sorcery/security/advisories/GHSA-jc8m-cxhj-668x", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/Sorcery/sorcery/commit/0f116d223826895a73b12492f17486e5d54ab7a7", "tags": ["Patch", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/Sorcery/sorcery/issues/231", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/Sorcery/sorcery/pull/235", "tags": ["Patch", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/Sorcery/sorcery/security/advisories/GHSA-jc8m-cxhj-668x", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-307"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-307"}]}], "descriptions": [{"lang": "en", "value": "In Sorcery before 0.15.0, there is a brute force vulnerability when using password authentication via Sorcery. The brute force protection submodule will prevent a brute force attack for the defined lockout period, but once expired, protection will not be re-enabled until a user or malicious actor logs in successfully. This does not affect users that do not use the built-in brute force protection submodule, nor users that use permanent account lockout. This has been patched in 0.15.0."}, {"lang": "es", "value": "En Sorcery versiones anteriores a 0.15.0, se presenta una vulnerabilidad de fuerza bruta cuando se utiliza la autenticaci\u00f3n de contrase\u00f1a por medio de Sorcery. El subm\u00f3dulo de protecci\u00f3n de fuerza bruta impedir\u00e1 un ataque de fuerza bruta durante el per\u00edodo de bloqueo definido, pero una vez que expire, la protecci\u00f3n no se volver\u00e1 a habilitar hasta que un usuario o actor malicioso inicie sesi\u00f3n con \u00e9xito. Esto no afecta a los usuarios que no usan el subm\u00f3dulo de protecci\u00f3n de fuerza bruta incorporado, ni a los usuarios que utilizan el bloqueo permanente de la cuenta. Esto ha sido parcheado en la versi\u00f3n 0.15.0."}], "lastModified": "2024-11-21T04:56:41.153", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sorcery_project:sorcery:*:*:*:*:*:ruby:*:*", "vulnerable": true, "matchCriteriaId": "07C2C42F-F970-4D1A-95FB-9EE238C0A190", "versionEndExcluding": "0.15.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}