CyberRota Analysis
AI-GeneratedTypemill's login endpoint is vulnerable due to the absence of rate-limiting and account lockout mechanisms when captcha is disabled, which is the default setting. This allows unauthenticated attackers to execute unlimited password-guessing attacks against any user account, including those of administrators, potentially leading to unauthorized access. Organizations using Typemill should prioritize addressing this vulnerability to safeguard their systems against brute-force attacks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Typemill's login endpoint (POST /tm/login, ControllerWebAuth::login) performs no rate-limiting, failed-attempt counting, or account lockout when captcha is disabled, which is the default configuration. An unauthenticated attacker can send unlimited password-guessing requests against any account, including administrators, with no throttling.