Description
Yamcs is a mission control framework. Prior to 5.12.7, the authentication endpoint POST /auth/token in yamcs-core, handled by yamcs-core/src/main/java/org/yamcs/http/auth/AuthHandler.java, lacked any rate limiting, account lockout, or failed-attempt throttling, so an unauthenticated remote attacker could perform unlimited password-guessing attempts against any user account, significantly increasing the risk of successful brute-force attacks. This issue is fixed in versions 5.12.7 and 5.13.0.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
yamcs yamcs
< 5.12.7affected
References
- https://github.com/yamcs/yamcs/security/advisories/GHSA-w5r6-mcgq-7pq4 ↗
- https://github.com/yamcs/yamcs/commit/309218c651680f79df11a8d0f8628f7033f98a83 ↗
- https://github.com/yamcs/yamcs/commit/64392df531fbcbc65f19ee5724c4c23d289f49fc ↗
- https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.7 ↗
- https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.0 ↗