CVE-2024-47656

The Shilpi Client Dashboard application does not implement sufficient restrictions (e.g., account lockout, CAPTCHA, attempt limit) for incorrect authentication attempts in the API interface used for login. An attacker can freely send consecutive login requests with different password combinations. This makes it possible to systematically guess the password using a brute force method, leading to unauthorized access to the victim's account.

An attacker can gain unauthorized access to accounts of other system users, potentially resulting in disclosure of sensitive data and the ability to perform operations on behalf of compromised accounts.

Apply patches available from the vendor according to the references. Additionally, it is recommended to implement mechanisms limiting the number of login attempts (rate limiting, account lockout after a specified number of failed attempts, CAPTCHA) as defense-in-depth measures.

Shilpi Client Dashboard — versions indicated in the vendor's references