CVE-2017-15887 - An improper restriction of excessive authentication attempts vulnerability in /principals in Synology CardDAV Server before 6.0.7-0085 allows remote attackers to obtain user credentials via a brute-force attack

Back Back to CVE browser

CRITICAL

An improper restriction of excessive authentication attempts vulnerability in /principals in Synology CardDAV Server before 6.0.7-0085 allows remote attackers to obtain user credentials via a brute-force attack

Published Nov 7, 2017

9.8

CRITICAL

CVSS 3.0

EPSS 1.94%

Description

An improper restriction of excessive authentication attempts vulnerability in /principals in Synology CardDAV Server before 6.0.7-0085 allows remote attackers to obtain user credentials via a brute-force attack.

Affected products

Vendor Synology Product Synology CardDAV Server Default
n/a
- Version
  before 6.0.7-0085
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Synology

Synology CardDAV Server

n/a

Version	Status	Constraints
before 6.0.7-0085	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-307

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2017-7306
Advisory
https://www.synology.com/en-global/support/security/Synology_SA_17_64_CardDAV_Server
x_refsource_CONFIRMIssue TrackingVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2017-7306		Advisory
https://www.synology.com/en-global/support/security/Synology_SA_17_64_CardDAV_Server		x_refsource_CONFIRMIssue TrackingVendor Advisory