CVE - CVE-2021-41171

CVE-ID
CVE-2021-41171	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
eLabFTW is an open source electronic lab notebook manager for research teams. In versions of eLabFTW before 4.1.0, it allows attackers to bypass a brute-force protection mechanism by using many different forged PHPSESSID values in HTTP Cookie header. This issue has been addressed by implementing brute force login protection, as recommended by Owasp with Device Cookies. This mechanism will not impact users and will effectively thwart any brute-force attempts at guessing passwords. The only correct way to address this is to upgrade to version 4.1.0. Adding rate limitation upstream of the eLabFTW service is of course a valid option, with or without upgrading.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
CONFIRM:https://github.com/elabftw/elabftw/security/advisories/GHSA-q67h-5pc3-g6jv URL:https://github.com/elabftw/elabftw/security/advisories/GHSA-q67h-5pc3-g6jv MISC:https://github.com/elabftw/elabftw/commit/8e92afeec4c3a68dc88333881b7e6307f425706b URL:https://github.com/elabftw/elabftw/commit/8e92afeec4c3a68dc88333881b7e6307f425706b MISC:https://github.com/elabftw/elabftw/releases/tag/4.1.0 URL:https://github.com/elabftw/elabftw/releases/tag/4.1.0 MISC:https://owasp.org/www-community/Slow_Down_Online_Guessing_Attacks_with_Device_Cookies URL:https://owasp.org/www-community/Slow_Down_Online_Guessing_Attacks_with_Device_Cookies MISC:https://www.exploit-db.com/docs/50436 URL:https://www.exploit-db.com/docs/50436
Assigning CNA
GitHub (maintainer security advisories)
Date Record Created
20210915	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20210915)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)