Vulnerability · Published Sep 5, 2024 · Assigned by VulDB

CVE-2024-8462Windmill HTTP Request users.rs excessive authentication

Low 3.7

In plain English

A low-severity security flaw in Windmill. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities).

Severity (CVSS 3.1)3.7Low

Exploit odds (30 days)0.5%top 54.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A vulnerability was found in Windmill 1.380.0. It has been classified as problematic. Affected is an unknown function of the file backend/windmill-api/src/users.rs of the component HTTP Request Handler. The manipulation leads to improper restriction of excessive authentication attempts. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. Upgrading to version 1.390.1 is able to address this issue. The patch is identified as acfe7786152f036f2476f93ab5536571514fa9e3. It is recommended to upgrade the affected component.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/windmill-labs/windmill	no fix listed	GHSA-g6q4-w3j3-jfc4
Go	github.com/windmill-labs/windmill	no fix listed	GO-2024-3118

Affected products (as reported)

Vendor	Product	Versions
n/a	Windmill	1.380.0

Weakness: CWE-307 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

References

VDB-276630 | Windmill HTTP Request users.rs excessive authentication vdb-entry
VDB-276630 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #401826 | Windmill Labs Windmill CE 1.380.0 Excessive Iteration third-party-advisory
https://github.com/windmill-labs/windmill/commit/acfe7786152f036f2476f93ab5536571514fa9e3 patch
https://github.com/windmill-labs/windmill/releases/tag/v1.390.1 patch