CVE-2024-55008
HighCVSS 7.5Exploitation Probability (EPSS)
Elevated risk51th percentile - higher than 51% of all known CVEs
Summary
JATOS 3.9.4 contains a denial-of-service (DoS) vulnerability in the authentication system. An attacker can lock a user account by sending 3 failed login attempts per minute, causing permanent account lockout. The lockout is account-based, not IP-based, so any attacker can lock any account.
Risk Assessment
The risk is the ability to permanently lock user accounts, potentially disrupting organizational operations and causing loss of productivity. The attack requires no privileges and can be performed remotely.
Recommendation
Immediately update JATOS to version 3.9.5 or later, which includes a fix. As a temporary workaround, consider limiting login attempts per IP address or implementing additional brute-force protection mechanisms.
Other vulnerabilities in JATOS
Original NVD description (English source)
JATOS 3.9.4 contains a denial-of-service (DoS) vulnerability in the authentication system, where an attacker can prevent legitimate users from accessing their accounts by repeatedly sending multiple failed login attempts. Specifically, by submitting 3 incorrect login attempts every minute, the attacker can trigger the account lockout mechanism on the account level, effectively locking the user out indefinitely. Since the lockout is applied to the user account and not based on the IP address, any attacker can trigger the lockout on any user account, regardless of their privileges.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS