CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
Improper Restriction of Excessive Authentication Attempts vulnerability in CodePeople Appointment Hour Booking allows Removing Important Client Functionality.This issue affects Appointment Hour Booking: from n/a through 1.4.56.
Explanation of Vulnerability in Simple Terms
Appointment Hour Booking versions up to 1.4.56 contain a weakness in rate limiting or brute-force protection that allows attackers to perform repeated actions without adequate throttling. An attacker can make many requests in quick succession over the network without authentication. This could enable password guessing, token enumeration, or other abuse of the booking system.
What an attacker can do
Make repeated requests to the booking system without being throttled or blocked.
Potential impact on your site
Attackers can brute-force passwords, enumerate valid booking slots or user accounts, or disrupt service availability through request flooding.
Conditions required to exploit
Network access to the vulnerable site; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
