CVE-2024-8462

LowCVSS 3.7/10Last modified Jun 17, 2026

Description

A vulnerability was found in Windmill 1.380.0. It has been classified as problematic. Affected is an unknown function of the file backend/windmill-api/src/users.rs of the component HTTP Request Handler. The manipulation leads to improper restriction of excessive authentication attempts. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. Upgrading to version 1.390.1 is able to address this issue. The patch is identified as acfe7786152f036f2476f93ab5536571514fa9e3. It is recommended to upgrade the affected component.

Metrics

CVSS 3.1 3.7/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-307

Affected software

No affected versions have been published.

Timeline

Published: Sep 5, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-84638.8File upload restriction bypass vulnerability in PHPGurukul Job Portal 1.0, the exploitation of which could allow an authenticated user to ex CVE-2024-84647.5SQL injection vulnerability, by which an attacker could send a specially designed query through JOBREGID parameter in /jobportal/admin/appli CVE-2024-84657.5SQL injection vulnerability, by which an attacker could send a specially designed query through user_id parameter in /jobportal/admin/user/c CVE-2024-84667.5SQL injection vulnerability, by which an attacker could send a specially designed query through CATEGORY parameter in /jobportal/admin/categ CVE-2024-84677.5SQL injection vulnerability, by which an attacker could send a specially designed query through id parameter in /jobportal/admin/category/in CVE-2024-84687.5SQL injection vulnerability, by which an attacker could send a specially designed query through search parameter in /jobportal/index.php, an CVE-2024-84697.5SQL injection vulnerability, by which an attacker could send a specially designed query through id parameter in /jobportal/admin/employee/in CVE-2024-84707.5SQL injection vulnerability, by which an attacker could send a specially designed query through CATEGORY parameter in /jobportal/admin/vacan CVE-2024-84716.1Cross-Site Scripting (XSS) vulnerability, whereby user-controlled input is not sufficiently encrypted. Exploitation of this vulnerability co CVE-2024-84726.1Cross-Site Scripting (XSS) vulnerability, whereby user-controlled input is not sufficiently encrypted. Exploitation of this vulnerability co CVE-2024-84736.1Cross-Site Scripting (XSS) vulnerability, whereby user-controlled input is not sufficiently encrypted. Exploitation of this vulnerability co CVE-2024-84747.5OpenVPN Connect before version 3.5.0 can contain the configuration profile's clear-text private key which is logged in the application log,