CVE-2016-10321: Improper Restriction of Excessive Authentication Attempts

April 10, 2017 (updated June 21, 2019)

web2py does not properly check if a host is denied before verifying passwords, allowing a remote attacker to perform brute-force attacks.

References

nvd.nist.gov/vuln/detail/CVE-2016-10321

Code Behaviors & Features

Detect and mitigate CVE-2016-10321 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →