{"containers": {"cna": {"affected": [{"product": "Sorcery", "vendor": "Sorcery", "versions": [{"status": "affected", "version": "< 0.15.0"}]}], "descriptions": [{"lang": "en", "value": "In Sorcery before 0.15.0, there is a brute force vulnerability when using password authentication via Sorcery. The brute force protection submodule will prevent a brute force attack for the defined lockout period, but once expired, protection will not be re-enabled until a user or malicious actor logs in successfully. This does not affect users that do not use the built-in brute force protection submodule, nor users that use permanent account lockout. This has been patched in 0.15.0."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 8.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-307", "description": "CWE-307: Improper Restriction of Excessive Authentication Attempts", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2020-05-07T20:25:14", "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/Sorcery/sorcery/security/advisories/GHSA-jc8m-cxhj-668x"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/Sorcery/sorcery/issues/231"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/Sorcery/sorcery/pull/235"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/Sorcery/sorcery/commit/0f116d223826895a73b12492f17486e5d54ab7a7"}], "source": {"advisory": "GHSA-jc8m-cxhj-668x", "discovery": "UNKNOWN"}, "title": "Improper Restriction of Excessive Authentication Attempts in Sorcery", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security-advisories@github.com", "ID": "CVE-2020-11052", "STATE": "PUBLIC", "TITLE": "Improper Restriction of Excessive Authentication Attempts in Sorcery"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Sorcery", "version": {"version_data": [{"version_value": "< 0.15.0"}]}}]}, "vendor_name": "Sorcery"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "In Sorcery before 0.15.0, there is a brute force vulnerability when using password authentication via Sorcery. The brute force protection submodule will prevent a brute force attack for the defined lockout period, but once expired, protection will not be re-enabled until a user or malicious actor logs in successfully. This does not affect users that do not use the built-in brute force protection submodule, nor users that use permanent account lockout. This has been patched in 0.15.0."}]}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 8.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-307: Improper Restriction of Excessive Authentication Attempts"}]}]}, "references": {"reference_data": [{"name": "https://github.com/Sorcery/sorcery/security/advisories/GHSA-jc8m-cxhj-668x", "refsource": "CONFIRM", "url": "https://github.com/Sorcery/sorcery/security/advisories/GHSA-jc8m-cxhj-668x"}, {"name": "https://github.com/Sorcery/sorcery/issues/231", "refsource": "MISC", "url": "https://github.com/Sorcery/sorcery/issues/231"}, {"name": "https://github.com/Sorcery/sorcery/pull/235", "refsource": "MISC", "url": "https://github.com/Sorcery/sorcery/pull/235"}, {"name": "https://github.com/Sorcery/sorcery/commit/0f116d223826895a73b12492f17486e5d54ab7a7", "refsource": "MISC", "url": "https://github.com/Sorcery/sorcery/commit/0f116d223826895a73b12492f17486e5d54ab7a7"}]}, "source": {"advisory": "GHSA-jc8m-cxhj-668x", "discovery": "UNKNOWN"}}}}, "cveMetadata": {"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "assignerShortName": "GitHub_M", "cveId": "CVE-2020-11052", "datePublished": "2020-05-07T20:25:14", "dateReserved": "2020-03-30T00:00:00", "dateUpdated": "2020-05-07T20:25:14", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:sorcery_project:sorcery:*:*:*:*:*:ruby:*:*", "matchCriteriaId": "07C2C42F-F970-4D1A-95FB-9EE238C0A190", "versionEndExcluding": "0.15.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "In Sorcery before 0.15.0, there is a brute force vulnerability when using password authentication via Sorcery. The brute force protection submodule will prevent a brute force attack for the defined lockout period, but once expired, protection will not be re-enabled until a user or malicious actor logs in successfully. This does not affect users that do not use the built-in brute force protection submodule, nor users that use permanent account lockout. This has been patched in 0.15.0."}, {"lang": "es", "value": "En Sorcery versiones anteriores a 0.15.0, se presenta una vulnerabilidad de fuerza bruta cuando se utiliza la autenticaci\u00f3n de contrase\u00f1a por medio de Sorcery. El subm\u00f3dulo de protecci\u00f3n de fuerza bruta impedir\u00e1 un ataque de fuerza bruta durante el per\u00edodo de bloqueo definido, pero una vez que expire, la protecci\u00f3n no se volver\u00e1 a habilitar hasta que un usuario o actor malicioso inicie sesi\u00f3n con \u00e9xito. Esto no afecta a los usuarios que no usan el subm\u00f3dulo de protecci\u00f3n de fuerza bruta incorporado, ni a los usuarios que utilizan el bloqueo permanente de la cuenta. Esto ha sido parcheado en la versi\u00f3n 0.15.0."}], "id": "CVE-2020-11052", "lastModified": "2020-05-13T13:59:20.707", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 8.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.7, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2020-05-07T21:15:11.483", "references": [{"source": "security-advisories@github.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/Sorcery/sorcery/commit/0f116d223826895a73b12492f17486e5d54ab7a7"}, {"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://github.com/Sorcery/sorcery/issues/231"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/Sorcery/sorcery/pull/235"}, {"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://github.com/Sorcery/sorcery/security/advisories/GHSA-jc8m-cxhj-668x"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-307"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-307"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}