PHP
CVE-2025-9551
MEDIUM
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Lifecycle Timeline
3DescriptionCVE.org
Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Protected Pages allows Brute Force.This issue affects Protected Pages: from 0.0.0 before 1.8.0, from 7.X-1.0 before 7.X-2.5.
AnalysisAI
Drupal Protected Pages module fails to implement rate limiting on authentication attempts, enabling unauthenticated attackers to conduct brute force attacks against password-protected content. Affected versions include Protected Pages 0.0.0 through 1.7.x and 7.x-1.0 through 7.x-2.4. The vulnerability permits attackers to enumerate valid credentials and bypass access controls through repeated login submissions without detection or throttling mechanisms. No public exploit code or active exploitation has been confirmed; EPSS scoring of 0.05% (15th percentile) indicates low real-world exploitation likelihood despite the moderate CVSS score of 6.5.
Technical ContextAI
The Protected Pages module for Drupal (CPE: cpe:2.3:a:protected_pages_project:protected_pages:*:*:*:*:*:drupal:*:*) provides functionality to restrict access to specific pages via password authentication. The vulnerability stems from CWE-307 (Improper Restriction of Excessive Authentication Attempts), a weakness in the authentication mechanism that fails to implement exponential backoff, account lockouts, CAPTCHA challenges, or IP-based rate limiting on failed login attempts. This allows attackers to submit unlimited authentication requests without temporal delays or behavioral detection, making brute force attacks computationally feasible. The flaw affects both Drupal 7.x and Drupal 8+ codebases of the module.
RemediationAI
Upgrade Protected Pages to version 1.8.0 or later for the 0.x/1.x branch, and 7.x-2.5 or later for the Drupal 7.x branch, as specified in the vendor advisory at https://www.drupal.org/sa-contrib-2025-101. If immediate patching is not feasible, implement external rate limiting via a reverse proxy (Apache mod_evasive, Nginx limit_req, or AWS WAF) to restrict authentication requests to 3-5 per minute per IP address, combined with temporary IP blocks after 10 failed attempts within 15 minutes. Additionally, consider requiring HTTPS-only connections and deploy a Web Application Firewall (WAF) rule to detect automated login enumeration patterns (e.g., rapid sequential requests to /protected-pages/login). Verify patched versions via the HeroDevs release notes at https://docs.herodevs.com/drupal/release-notes/protected-pages.
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
NetAlertX (formerly PiAlert) versions 23.01.14 through 24.x before 24.10.12 allow unauthenticated command injection thro
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
Share
External POC / Exploit Code
Leaving vuln.today