description: A improper restriction of excessive authentication attempts vulnerability [CWE-307] in Fortinet FortiDeceptor 3.1.x and before allows  a remote unauthenticated attacker to partially exhaust CPU and memory via sending numerous HTTP requests to the login form.
problem types: Denial of service
affected:
{
vendor: Fortinet
product: FortiDeceptor
defaultStatus: unaffected
versions:
versionType: semver, version: 3.1.0, lessThanOrEqual: 3.1.1, status: affected
versionType: semver, version: 3.0.0, lessThanOrEqual: 3.0.2, status: affected
version: 2.1.0, status: affected
version: 2.0.0, status: affected
version: 1.1.0, status: affected
versionType: semver, version: 1.0.0, lessThanOrEqual: 1.0.1, status: affected
}
metrics:
format: CVSS
cvssV3_1: [
version: 3.1
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 3.5
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:X
]
solutions: Please upgrade to FortiAuthenticator version 6.5.0 or above,
Please upgrade to FortiDeceptor version 3.2.0 or above.
Please upgrade to FortiMail version 6.4.1 or above,
Please upgrade to FortiMail version 6.2.5 or above,
Please upgrade to FortiMail version 6.0.10 or above.