Access Code
Monthly
The Drupal Access Code module (versions before 2.0.5) lacks rate limiting on its access code entry form, allowing brute-force guessing of access codes. While the vendor's CVSS vector indicates some authentication is required (PR:L), our independent analysis rates it as unauthenticated (PR:N) with limited impact-only the low-sensitivity access protected by the code-not full site compromise. No public exploit code is identified, and EPSS is low (0.24%, 13th percentile).
Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Access code allows Brute Force.0.0 before 2.0.4. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
The Drupal Access Code module (versions before 2.0.5) lacks rate limiting on its access code entry form, allowing brute-force guessing of access codes. While the vendor's CVSS vector indicates some authentication is required (PR:L), our independent analysis rates it as unauthenticated (PR:N) with limited impact-only the low-sensitivity access protected by the code-not full site compromise. No public exploit code is identified, and EPSS is low (0.24%, 13th percentile).
Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Access code allows Brute Force.0.0 before 2.0.4. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.