CVE-2022-2650: wger vulnerable to brute force attempts
9.8
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.31133%
CWE
Published
11/24/2022
Updated
2/2/2023
KEV Status
No
Technology
Python
PythonTechnical Details
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| wger | pip | < 2.2 | 2.2 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability stems from improper restriction of authentication attempts. The key evidence is the addition of django-axes (a security tool for blocking brute force attacks) in the patched commit. The UserAPILoginView's POST handler in views.py was vulnerable because:
- It had AllowAny permissions with no rate limiting in vulnerable versions
- The patch added deprecation warnings and JWT authentication, but more crucially introduced AXES_FAILURE_LIMIT and AXES_COOLOFF_TIME configurations
- The original code showed no evidence of failed attempt tracking or lockout mechanisms
- The CWE-307 directly maps to unprotected authentication endpoints vulnerable to brute-forcing