Vulnerability · Published Mar 26, 2021 · Assigned by mitre

CVE-2021-28248

High 7.5

In plain English

A high-severity security flaw in the affected software. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 72% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)1.4%top 27.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

CA eHealth Performance Manager through 6.3.2.12 is affected by Improper Restriction of Excessive Authentication Attempts. An attacker is able to perform an arbitrary number of /web/frames/ authentication attempts using different passwords, and eventually gain access to a targeted account, NOTE: This vulnerability only affects products that are no longer supported by the maintainer

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

Weakness: CWE-307 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

https://n4nj0.github.io/advisories/ca-ehealth-performance-manager/ x_refsource_MISC