CVE-2016-8347 Auth bypass in Kabona AB WDC prior to Version 3.4.0
Kabona AB WDC lacks rate limiting on authentication attempts, allowing attackers to perform brute force attacks to gain unauthorized access.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2016-8347?
CVE-2016-8347 is a critical authentication bypass vulnerability in Kabona AB WDC prior to Version 3.4.0, published on 13 Feb 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in Kabona AB WebDatorCentral (WDC) application prior to Version 3.4.0. WDC does not limit authentication attempts that may allow a brute force attack method.
Weakness: CWE-287
Which versions are affected by CVE-2016-8347?
It affects 1 product.
Products include Kabona Ab Webdatorcentral.
How do I fix CVE-2016-8347?
No fix has been published for CVE-2016-8347 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2016-8347 being exploited?
There is no known exploitation of CVE-2016-8347 in the wild and no public exploit code.
Other vulnerabilities in Kabona AB WDC prior to Version 3.4.0
Sources
Also known as GHSA-x2v8-652m-p279.