CVE-2014-9006 – Monstra 3.0.1 and earlier uses a cookie to track how many login attempts

Monstra 3.0.1 and earlier uses a cookie to track how many login attempts have been attempted, which allows remote attackers to conduct brute force login attacks by deleting the login_attempts cookie or setting it to certain values.

 

Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9006

Reference (s):

• http://packetstormsecurity.com/files/129082/Monstra-3.0.1-Bruteforce-Mitigation-Bypass.html
• XF:monstra-index-brute-force(98649)
• URL: https://exchange.xforce.ibmcloud.com/vulnerabilities/98649