CVE-2021-28248

Published: Mar 26, 2021Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

CA eHealth Performance Manager through 6.3.2.12 is affected by Improper Restriction of Excessive Authentication Attempts. An attacker is able to perform an arbitrary number of /web/frames/ authentication attempts using different passwords, and eventually gain access to a targeted account, NOTE: This vulnerability only affects products that are no longer supported by the maintainer

Affected (1)

Products: Broadcom: Ehealth

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Broadcom Ehealth	Up to 6.3.2.12

Related CWEs

Improper Restriction of Excessive Authentication Attempts

The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks.

References (2)

https://n4nj0.github.io/advisories/ca-ehealth-performance-manager/

Source: cve@mitre.org

ExploitThird Party Advisory

https://n4nj0.github.io/advisories/ca-ehealth-performance-manager/

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.