Zipline before 4.6.4 Rate Limit Bypass via Query String and Header
概要
Zipline before 4.6.4 contains a rate limit bypass vulnerability that allows remote attackers to evade request limits by varying query strings or supplying the x-zipline-p-filename header. Attackers can append differing query parameters to login and file or short-link password verification endpoints...
影響パッケージ
| パッケージ | 影響を受ける版 → 修正版 | |
|---|---|---|
| dicedzipline |
4.6.4 未満→ 4.6.4 |
4.6.4 |
原文の説明 取得元が公開している説明をそのまま載せています (多くは英語)。
Zipline before 4.6.4 contains a rate limit bypass vulnerability that allows remote attackers to evade request limits by varying query strings or supplying the x-zipline-p-filename header. Attackers can append differing query parameters to login and file or short-link password verification endpoints to perform credential guessing beyond the intended rate limits.
出典: CVE.org (CVE Program・cvelistV5) NVD