PHP CVE-2025-9551
MEDIUMCVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Lifecycle Timeline
3DescriptionNVD
Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Protected Pages allows Brute Force.This issue affects Protected Pages: from 0.0.0 before 1.8.0, from 7.X-1.0 before 7.X-2.5.
AnalysisAI
Drupal Protected Pages module fails to implement rate limiting on authentication attempts, enabling unauthenticated attackers to conduct brute force attacks against password-protected content. Affected versions include Protected Pages 0.0.0 through 1.7.x and 7.x-1.0 through 7.x-2.4. The vulnerability permits attackers to enumerate valid credentials and bypass access controls through repeated login submissions without detection or throttling mechanisms. No public exploit code or active exploitation has been confirmed; EPSS scoring of 0.05% (15th percentile) indicates low real-world exploitation likelihood despite the moderate CVSS score of 6.5.
Technical ContextAI
The Protected Pages module for Drupal (CPE: cpe:2.3:a:protected_pages_project:protected_pages:*:*:*:*:*:drupal:*:*) provides functionality to restrict access to specific pages via password authentication. The vulnerability stems from CWE-307 (Improper Restriction of Excessive Authentication Attempts), a weakness in the authentication mechanism that fails to implement exponential backoff, account lockouts, CAPTCHA challenges, or IP-based rate limiting on failed login attempts. This allows attackers to submit unlimited authentication requests without temporal delays or behavioral detection, making brute force attacks computationally feasible. The flaw affects both Drupal 7.x and Drupal 8+ codebases of the module.
RemediationAI
Upgrade Protected Pages to version 1.8.0 or later for the 0.x/1.x branch, and 7.x-2.5 or later for the Drupal 7.x branch, as specified in the vendor advisory at https://www.drupal.org/sa-contrib-2025-101. If immediate patching is not feasible, implement external rate limiting via a reverse proxy (Apache mod_evasive, Nginx limit_req, or AWS WAF) to restrict authentication requests to 3-5 per minute per IP address, combined with temporary IP blocks after 10 failed attempts within 15 minutes. Additionally, consider requiring HTTPS-only connections and deploy a Web Application Firewall (WAF) rule to detect automated login enumeration patterns (e.g., rapid sequential requests to /protected-pages/login). Verify patched versions via the HeroDevs release notes at https://docs.herodevs.com/drupal/release-notes/protected-pages.
Share
External POC / Exploit Code
Leaving vuln.today