Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an unauthenticated attacker who knows an account email address or username can abuse the account lockout mechanism of a local-authentication collection to prevent that account from signing in. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.
Weakness
The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Payload | Payloadcms | * | 3.90.0 (excluding) |
| Payload | Payloadcms | 4.0.0-canary0 (including) | 4.0.0-canary0 (including) |
| Payload | Payloadcms | 4.0.0-canary1 (including) | 4.0.0-canary1 (including) |
| Payload | Payloadcms | 4.0.0-canary10 (including) | 4.0.0-canary10 (including) |
| Payload | Payloadcms | 4.0.0-canary11 (including) | 4.0.0-canary11 (including) |
| Payload | Payloadcms | 4.0.0-canary12 (including) | 4.0.0-canary12 (including) |
| Payload | Payloadcms | 4.0.0-canary13 (including) | 4.0.0-canary13 (including) |
| Payload | Payloadcms | 4.0.0-canary14 (including) | 4.0.0-canary14 (including) |
| Payload | Payloadcms | 4.0.0-canary15 (including) | 4.0.0-canary15 (including) |
| Payload | Payloadcms | 4.0.0-canary16 (including) | 4.0.0-canary16 (including) |
| Payload | Payloadcms | 4.0.0-canary17 (including) | 4.0.0-canary17 (including) |
| Payload | Payloadcms | 4.0.0-canary18 (including) | 4.0.0-canary18 (including) |
| Payload | Payloadcms | 4.0.0-canary19 (including) | 4.0.0-canary19 (including) |
| Payload | Payloadcms | 4.0.0-canary2 (including) | 4.0.0-canary2 (including) |
| Payload | Payloadcms | 4.0.0-canary20 (including) | 4.0.0-canary20 (including) |
| Payload | Payloadcms | 4.0.0-canary21 (including) | 4.0.0-canary21 (including) |
| Payload | Payloadcms | 4.0.0-canary22 (including) | 4.0.0-canary22 (including) |
| Payload | Payloadcms | 4.0.0-canary23 (including) | 4.0.0-canary23 (including) |
| Payload | Payloadcms | 4.0.0-canary24 (including) | 4.0.0-canary24 (including) |
| Payload | Payloadcms | 4.0.0-canary25 (including) | 4.0.0-canary25 (including) |
| Payload | Payloadcms | 4.0.0-canary26 (including) | 4.0.0-canary26 (including) |
| Payload | Payloadcms | 4.0.0-canary27 (including) | 4.0.0-canary27 (including) |
| Payload | Payloadcms | 4.0.0-canary28 (including) | 4.0.0-canary28 (including) |
| Payload | Payloadcms | 4.0.0-canary29 (including) | 4.0.0-canary29 (including) |
| Payload | Payloadcms | 4.0.0-canary3 (including) | 4.0.0-canary3 (including) |
| Payload | Payloadcms | 4.0.0-canary30 (including) | 4.0.0-canary30 (including) |
| Payload | Payloadcms | 4.0.0-canary31 (including) | 4.0.0-canary31 (including) |
| Payload | Payloadcms | 4.0.0-canary32 (including) | 4.0.0-canary32 (including) |
| Payload | Payloadcms | 4.0.0-canary33 (including) | 4.0.0-canary33 (including) |
| Payload | Payloadcms | 4.0.0-canary4 (including) | 4.0.0-canary4 (including) |
| Payload | Payloadcms | 4.0.0-canary5 (including) | 4.0.0-canary5 (including) |
| Payload | Payloadcms | 4.0.0-canary6 (including) | 4.0.0-canary6 (including) |
| Payload | Payloadcms | 4.0.0-canary7 (including) | 4.0.0-canary7 (including) |
| Payload | Payloadcms | 4.0.0-canary8 (including) | 4.0.0-canary8 (including) |
| Payload | Payloadcms | 4.0.0-canary9 (including) | 4.0.0-canary9 (including) |
Potential Mitigations
Common protection mechanisms include:
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482].
Consider using libraries with authentication capabilities such as OpenSSL or the ESAPI Authenticator. [REF-45]
Related Attack Patterns
- https://cwe.mitre.org/data/definitions/16.html
- https://cwe.mitre.org/data/definitions/49.html
- https://cwe.mitre.org/data/definitions/560.html
- https://cwe.mitre.org/data/definitions/565.html
- https://cwe.mitre.org/data/definitions/600.html
- https://cwe.mitre.org/data/definitions/652.html
- https://cwe.mitre.org/data/definitions/653.html