CVE-2021-28248
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
CA eHealth Performance Manager through 6.3.2.12 is affected by Improper Restriction of Excessive Authentication Attempts. An attacker is able to perform an arbitrary number of /web/frames/ authentication attempts using different passwords, and eventually gain access to a targeted account, NOTE: This vulnerability only affects products that are no longer supported by the maintainer
CA eHealth Performance Manager versiones hasta 6.3.2.12, está afectado por la Restricción Inapropiada de Intentos de Autenticación Excesivos. Un atacante puede ser capaz de llevar a cabo una cantidad arbitrario de intentos de autenticación /web/frames/ usando diferentes contraseñas y, finalmente, conseguir acceso a una cuenta de destino. NOTA: Esta vulnerabilidad solo afecta a los productos que ya no son compatibles por el mantenedor.
CVSS Scores
SSVC
- Decision:Attend
Timeline
- 2021-03-12 CVE Reserved
- 2021-03-26 CVE Published
- 2024-08-03 CVE Updated
- 2024-08-03 First Exploit
- 2025-03-30 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-307: Improper Restriction of Excessive Authentication Attempts
CAPEC
References (1)
| URL | Tag | Source |
|---|
| URL | Date | SRC |
|---|---|---|
| https://n4nj0.github.io/advisories/ca-ehealth-performance-manager | 2024-08-03 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Broadcom Search vendor "Broadcom" | Ehealth Search vendor "Broadcom" for product "Ehealth" | <= 6.3.2.12 Search vendor "Broadcom" for product "Ehealth" and version " <= 6.3.2.12" | - |
Affected
| ||||||