« Volver al listado

CVE-2025-7393

Estado: AnalizadaCrítica (9.8)—

Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Mail Login allows Brute Force.This issue affects Mail Login: from 3.0.0 before 3.2.0, from 4.0.0 before 4.2.0.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

CWE-307 (falta de restricción en intentos de autenticación) permite ataque de fuerza bruta remoto sin privilegios (AV:N, PR:N, UI:N) contra Mail Login. El impacto es acceso a credenciales válidas y cuentas de usuario (C:H, I:H).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Update SoftwareVulnerability ScanningPrivileged Account ManagementPassword PoliciesNetwork SegmentationMulti-factor Authentication

Tecnologías afectadas (1)

Mqanneh — Mail Login

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-7393",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-7393",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-07-22T14:06:55.624230Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "mlhess@drupal.org",
      "affectedData": [
        {
          "repo": "https://git.drupalcode.org/project/mail_login",
          "vendor": "Drupal",
          "product": "Mail Login",
          "versions": [
            {
              "status": "affected",
              "version": "3.0.0",
              "lessThan": "3.2.0",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "4.0.0",
              "lessThan": "4.2.0",
              "versionType": "semver"
            }
          ],
          "collectionURL": "https://www.drupal.org/project/mail_login",
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-07-21T17:15:37.640",
  "references": [
    {
      "url": "https://www.drupal.org/sa-contrib-2025-088",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "mlhess@drupal.org"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "mlhess@drupal.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-307"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Mail Login allows Brute Force.This issue affects Mail Login: from 3.0.0 before 3.2.0, from 4.0.0 before 4.2.0."
    },
    {
      "lang": "es",
      "value": "La vulnerabilidad de restricción incorrecta de intentos excesivos de autenticación en Drupal Mail Login permite la fuerza bruta. Este problema afecta a Mail Login: desde la versión 3.0.0 hasta la 3.2.0 y desde la versión 4.0.0 hasta la 4.2.0."
    }
  ],
  "lastModified": "2026-06-17T10:04:50.067",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mqanneh:mail_login:*:*:*:*:*:drupal:*:*",
              "vulnerable": true,
              "matchCriteriaId": "292C00C1-7721-4166-AF7E-F9E6D092722E",
              "versionEndExcluding": "3.2.0",
              "versionStartIncluding": "3.0.0"
            },
            {
              "criteria": "cpe:2.3:a:mqanneh:mail_login:*:*:*:*:*:drupal:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4F3280AC-538E-47FA-9A5B-54F235AFC3C9",
              "versionEndExcluding": "4.2.0",
              "versionStartIncluding": "4.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "mlhess@drupal.org"
}