CVE-2025-3129 - Vulnerability Details - OpenCVE

Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Access code allows Brute Force.This issue affects Access code: from 0.0.0 before 2.0.4.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

No data.

No data.

No data.

References

Link	Providers
https://www.drupal.org/sa-contrib-2025-028

History

Wed, 16 Apr 2025 20:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 15 Apr 2025 15:45:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 4.8, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N'}`

Wed, 02 Apr 2025 21:30:00 +0000

Type	Values Removed	Values Added
Description		Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Access code allows Brute Force.This issue affects Access code: from 0.0.0 before 2.0.4.
Title		Access code - Moderately critical - Access bypass - SA-CONTRIB-2025-028
Weaknesses		CWE-307
References		https://www.drupal.org/sa-contrib-2025-028

MITRE

Status: PUBLISHED

Assigner: drupal

Published: 2025-04-02T21:10:22.236Z

Updated: 2025-04-15T14:11:12.235Z

Reserved: 2025-04-02T16:30:40.988Z

Link: CVE-2025-3129

Vulnrichment

Updated: 2025-04-15T14:11:01.567Z

NVD

Status : Awaiting Analysis

Published: 2025-04-02T22:15:21.593

Modified: 2025-04-15T15:16:09.733

Link: CVE-2025-3129

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-3129", "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "state": "PUBLISHED", "assignerShortName": "drupal", "dateReserved": "2025-04-02T16:30:40.988Z", "datePublished": "2025-04-02T21:10:22.236Z", "dateUpdated": "2025-04-15T14:11:12.235Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://www.drupal.org/project/access_code", "defaultStatus": "unaffected", "product": "Access code", "repo": "https://git.drupalcode.org/project/access_code", "vendor": "Drupal", "versions": [{"lessThan": "2.0.4", "status": "affected", "version": "0.0.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Marcin Maruszewski (marcin maruszewski)"}, {"lang": "en", "type": "remediation developer", "value": "Gergely Lekli (glekli)"}, {"lang": "en", "type": "coordinator", "value": "Greg Knaddison (greggles)"}, {"lang": "en", "type": "coordinator", "value": "Drew Webber (mcdruid)"}, {"lang": "en", "type": "coordinator", "value": "Juraj Nemec (poker10)"}], "datePublic": "2025-04-02T17:02:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Access code allows Brute Force.<p>This issue affects Access code: from 0.0.0 before 2.0.4.</p>"}], "value": "Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Access code allows Brute Force.This issue affects Access code: from 0.0.0 before 2.0.4."}], "impacts": [{"capecId": "CAPEC-112", "descriptions": [{"lang": "en", "value": "CAPEC-112 Brute Force"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-307", "description": "CWE-307 Improper Restriction of Excessive Authentication Attempts", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "shortName": "drupal", "dateUpdated": "2025-04-02T21:10:22.236Z"}, "references": [{"url": "https://www.drupal.org/sa-contrib-2025-028"}], "source": {"discovery": "UNKNOWN"}, "title": "Access code - Moderately critical - Access bypass - SA-CONTRIB-2025-028", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-04-15T14:11:06.527496Z", "id": "CVE-2025-3129", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-15T14:11:12.235Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-3129", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-04-15T14:11:06.527496Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-15T14:11:01.567Z"}}], "cna": {"title": "Access code - Moderately critical - Access bypass - SA-CONTRIB-2025-028", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Marcin Maruszewski (marcin maruszewski)"}, {"lang": "en", "type": "remediation developer", "value": "Gergely Lekli (glekli)"}, {"lang": "en", "type": "coordinator", "value": "Greg Knaddison (greggles)"}, {"lang": "en", "type": "coordinator", "value": "Drew Webber (mcdruid)"}, {"lang": "en", "type": "coordinator", "value": "Juraj Nemec (poker10)"}], "impacts": [{"capecId": "CAPEC-112", "descriptions": [{"lang": "en", "value": "CAPEC-112 Brute Force"}]}], "affected": [{"repo": "https://git.drupalcode.org/project/access_code", "vendor": "Drupal", "product": "Access code", "versions": [{"status": "affected", "version": "0.0.0", "lessThan": "2.0.4", "versionType": "semver"}], "collectionURL": "https://www.drupal.org/project/access_code", "defaultStatus": "unaffected"}], "datePublic": "2025-04-02T17:02:00.000Z", "references": [{"url": "https://www.drupal.org/sa-contrib-2025-028"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Access code allows Brute Force.This issue affects Access code: from 0.0.0 before 2.0.4.", "supportingMedia": [{"type": "text/html", "value": "Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Access code allows Brute Force.<p>This issue affects Access code: from 0.0.0 before 2.0.4.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-307", "description": "CWE-307 Improper Restriction of Excessive Authentication Attempts"}]}], "providerMetadata": {"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "shortName": "drupal", "dateUpdated": "2025-04-02T21:10:22.236Z"}}}, "cveMetadata": {"cveId": "CVE-2025-3129", "state": "PUBLISHED", "dateUpdated": "2025-04-15T14:11:12.235Z", "dateReserved": "2025-04-02T16:30:40.988Z", "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "datePublished": "2025-04-02T21:10:22.236Z", "assignerShortName": "drupal"}, "dataVersion": "5.1"}