CVE-2021-3138 – Discourse 2.7.0 2FA Bypass

https://notcve.org/view.php?id=CVE-2021-3138

In Discourse 2.7.0 through beta1, a rate-limit bypass leads to a bypass of the 2FA requirement for certain forms. En Discourse versiones 2.7.0 hasta beta1, una omisión del límite de velocidad conlleva a una omisión del requisito de 2FA para determinadas formularios Discourse version 2.7.0 suffers from a 2FA bypass via a rate limiting bypass vulnerability. • https://github.com/Mesh3l911/CVE-2021-3138 http://packetstormsecurity.com/files/162256/Discourse-2.7.0-2FA-Bypass.html https://github.com/Mesh3l911/Disource https://github.com/discourse/discourse/releases • CWE-307: Improper Restriction of Excessive Authentication Attempts •