CVE-2021-41171

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

eLabFTW is an open source electronic lab notebook manager for research teams. In versions of eLabFTW before 4.1.0, it allows attackers to bypass a brute-force protection mechanism by using many different forged PHPSESSID values in HTTP Cookie header. This issue has been addressed by implementing brute force login protection, as recommended by Owasp with Device Cookies. This mechanism will not impact users and will effectively thwart any brute-force attempts at guessing passwords. The only correct way to address this is to upgrade to version 4.1.0. Adding rate limitation upstream of the eLabFTW service is of course a valid option, with or without upgrading.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-307

Affected software

Vendor	Product	Versions
elabftw	elabftw	< 4.1.0

References

https://github.com/elabftw/elabftw/commit/8e92afeec4c3a68dc88333881b7e6307f425706bPatch, Third Party Advisory
https://github.com/elabftw/elabftw/releases/tag/4.1.0Release Notes, Third Party Advisory
https://github.com/elabftw/elabftw/security/advisories/GHSA-q67h-5pc3-g6jvThird Party Advisory
https://owasp.org/www-community/Slow_Down_Online_Guessing_Attacks_with_Device_CookiesThird Party Advisory
https://www.exploit-db.com/docs/50436Exploit, Third Party Advisory, VDB Entry
https://github.com/elabftw/elabftw/commit/8e92afeec4c3a68dc88333881b7e6307f425706bPatch, Third Party Advisory
https://github.com/elabftw/elabftw/releases/tag/4.1.0Release Notes, Third Party Advisory
https://github.com/elabftw/elabftw/security/advisories/GHSA-q67h-5pc3-g6jvThird Party Advisory
https://owasp.org/www-community/Slow_Down_Online_Guessing_Attacks_with_Device_CookiesThird Party Advisory
https://www.exploit-db.com/docs/50436Exploit, Third Party Advisory, VDB Entry

Timeline

Published: Oct 22, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-411725.4AS_Redis is an AntSword plugin for Redis. The Redis Manage plugin for AntSword prior to version 0.5 is vulnerable to Self-XSS due to due to CVE-2021-411735.7Go Ethereum is the official Golang implementation of the Ethereum protocol. Prior to version 1.10.9, a vulnerable node is susceptible to cra CVE-2021-411746.1Grafana is an open-source platform for monitoring and observability. In affected versions if an attacker is able to convince a victim to vis CVE-2021-411755.4Pi-hole's Web interface (based on AdminLTE) provides a central location to manage one's Pi-hole and review the statistics generated by FTLDN CVE-2021-411764.3Pterodactyl is an open-source game server management panel built with PHP 7, React, and Go. In affected versions of Pterodactyl a malicious CVE-2021-411778.1Nextcloud is an open-source, self-hosted productivity platform. Prior to versions 20.0.13, 21.0.5, and 22.2.0, Nextcloud Server did not impl CVE-2021-411786.5Nextcloud is an open-source, self-hosted productivity platform. Prior to versions 20.0.13, 21.0.5, and 22.2.0, a file traversal vulnerabilit CVE-2021-411796.5Nextcloud is an open-source, self-hosted productivity platform. Prior to Nextcloud Server versions 20.0.13, 21.0.5, and 22.2.0, the Two-Fact CVE-2021-41187.8pytorch-lightning is vulnerable to Deserialization of Untrusted Data CVE-2021-411806.1Nextcloud talk is a self hosting messaging service. In versions prior 12.1.2 an attacker is able to control the link of a geolocation previe CVE-2021-411812.4Nextcloud talk is a self hosting messaging service. In versions prior to 12.3.0 the Nextcloud Android Talk application did not properly dete CVE-2021-411826.1jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `altField` option of the Datepi