CVE-2021-37934

Published: Dec 10, 2021Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

Due to insufficient server-side login-attempt limit enforcement, a vulnerability in /account/login in Huntflow Enterprise before 3.10.14 could allow an unauthenticated, remote user to perform multiple login attempts for brute-force password guessing.

Affected (1)

Products: Huntflow: Huntflow Enterprise

1 product

Huntflow Enterprise

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Huntflow Huntflow Enterprise	Before 3.10.14

Related CWEs

Improper Restriction of Excessive Authentication Attempts

The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks.

References (2)

https://gist.github.com/andrey-lomtev/4ec9004101152ea9d0043a09d59498a6

Source: cve@mitre.org

ExploitThird Party Advisory

https://gist.github.com/andrey-lomtev/4ec9004101152ea9d0043a09d59498a6

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.