Security Resilience

CVE-2023-51544

Metagauss Registrationmagic ≤ 5.2.5.1

Published
04 June 2024
Modified
04 February 2025
CVSS Score v3.1 5.3
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
EPSS Score 0.0033 25th percentile
Risk Priority 44 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2023-51544 is a medium-severity Improper Control of Interaction Frequency (CWE-799) vulnerability in Metagauss Registrationmagic. Its CVSS base score is 5.3 (Medium).

Operationally, ranked at the 25th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to AC-10 (Concurrent Session Control) and AC-7 (Unsuccessful Logon Attempts) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

A06:2025 Insecure Design

EU & UK References

Vulnerability Data

Improper Control of Interaction Frequency vulnerability in Metagauss RegistrationMagic allows Functionality Misuse.This issue affects RegistrationMagic: from n/a through 5.2.5.0.

CWE(s)
CWE-799NVD-CWE-Other

Related Threats

CVEs Like This One

CVE-2023-49831Same product: Metagauss Registrationmagic
CVE-2024-2951Same product: Metagauss Registrationmagic
CVE-2023-25991Same product: Metagauss Registrationmagic
CVE-2023-51509Same product: Metagauss Registrationmagic
CVE-2024-10508Same product: Metagauss Registrationmagic
CVE-2025-24686Same product: Metagauss Registrationmagic
CVE-2024-1991Same product: Metagauss Registrationmagic
CVE-2024-39643Same product: Metagauss Registrationmagic
CVE-2024-1990Same product: Metagauss Registrationmagic
CVE-2023-23989Same product: Metagauss Registrationmagic

Affected Assets

metagauss
registrationmagic
≤ 5.2.5.1

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

AC-10 Concurrent Session Control good match

ac-10 enforces a hard limit on concurrent sessions per user, directly stopping uncontrolled interaction frequency at the session level.

AC-7 Unsuccessful Logon Attempts good match

ac-7 directly enforces a limit on the frequency of invalid authentication attempts, structurally preventing the weakness for that interaction class.

SC-5 Denial-of-service Protection partial match

sc-5 reduces the impact of excessive request volume (DoS) but does not itself impose the frequency controls whose absence defines the weakness.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.26 Application security requirements partial match
blocks

Application security requirements explicitly include controls on interaction frequency and throttling.

A.8.27 Secure system architecture and engineering principles partial match
blocks

Secure architecture principles recommend rate-limiting and resource-management mechanisms.

A.8.28 Secure coding partial match
prevents

Secure coding practices can embed input-frequency and throttling checks in code.

A.8.6 Capacity management partial match
degrades

Capacity management directly limits request rates and resource exhaustion that CWE-799 describes.

Hardening callouts derived

DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.

  • No fine-grained STIG row for CWE-799, a class-level weakness. Rules are authored against its narrower children: CWE-307.

References