CVE-2023-49443

DoraCMS v2.1.8 reuses the same verification code when validating username and password, instead of generating a new code for each login attempt. This mechanism (CWE-307 – lack of restrictions on excessive authentication attempts) allows an attacker to make multiple login attempts without invalidating the verification code. As a result, automated mass testing of authentication credentials using brute-force method is possible.

An attacker can gain unauthorized access to a user or administrator account of the application, potentially resulting in complete system takeover and violation of data confidentiality, integrity, and availability.

Patches available from the vendor should be applied according to references. Additionally, it is recommended to implement mechanisms limiting login attempts (e.g., account lockout after a specified number of failed attempts, CAPTCHA, rate limiting) and enforce generation of a new verification code after each authentication attempt.

DoraCMS v2.1.8