CVE-2022-2166

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Improper Restriction of Excessive Authentication Attempts in GitHub repository mastodon/mastodon prior to 4.0.0.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-307

Affected software

VendorProductVersions
mastodonmastodon/mastodon>= unspecified, < 4.0.0

References

Timeline

Published
Nov 16, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-216608.1Gin-vue-admin is a backstage management system based on vue and gin. In versions prior to 2.4.7 low privilege users are able to modify higheCVE-2022-216617.5WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Due to improper sanitizatioCVE-2022-216625.4WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Low-privileged authenticateCVE-2022-216637.2WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. On a multisite, users with CVE-2022-216648.8WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Due to lack of proper sanitCVE-2022-216667.2Useful Simple Open-Source CMS (USOC) is a content management system (CMS) for programmers. Versions prior to Pb2.4Bfx3 allowed Sql injectionCVE-2022-216677.5soketi is an open-source WebSockets server. There is an unhandled case when reading POST requests which results in the server crashing if itCVE-2022-216688.6pipenv is a Python development workflow tool. Starting with version 2018.10.9 and prior to version 2022.1.8, a flaw in pipenv's parsing of rCVE-2022-216697.5PuddingBot is a group management bot. In version 0.0.6-b933652 and prior, the bot token is publicly exposed in main.py, making it accessibleCVE-2022-21676.1The Newspaper WordPress theme before 12 does not sanitise a parameter before outputting it back in an HTML attribute via an AJAX action, leaCVE-2022-216705.3markdown-it is a Markdown parser. Prior to version 1.3.2, special patterns with length greater than 50 thousand characterss could slow down CVE-2022-216716.5@replit/crosis is a JavaScript client that speaks Replit's container protocol. A vulnerability that involves exposure of sensitive informati
CVE-2022-2166: Critical severity, CVSS 9.8 | Vulnix