The htdocs/index.php?mainmenu=home login page in Dolibarr 10.0.6 allows an unlimited rate of failed authentication attempts.
The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Dolibarr_erp/crm | Dolibarr | 10.0.6 (including) | 10.0.6 (including) |
| Dolibarr | Ubuntu | esm-apps/xenial | * |
| Dolibarr | Ubuntu | trusty | * |
| Dolibarr | Ubuntu | xenial | * |
Common protection mechanisms include:
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482].
Consider using libraries with authentication capabilities such as OpenSSL or the ESAPI Authenticator. [REF-45]