CVE-2023-0777: Authentication Bypass in modoboa
9.8
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.98699%
CWE
Published
2/10/2023
Updated
9/24/2024
KEV Status
No
Technology
Python
PythonTechnical Details
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| modoboa | pip | <= 2.0.3 | 2.0.4 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability stems from missing API throttling mechanisms in authentication-related endpoints. The patch adds throttle_classes to these views (LoginThrottle, PasswordResetRequestThrottle, etc.) and implements a GetThrottleViewsetMixin across critical endpoints. Prior to 2.0.4, these authentication flows lacked rate limiting, enabling brute-force attacks and credential stuffing. The affected functions are clearly identified in the diff as receiving throttling protections in the patched version.