Cyber Resilience

CVE-2024-57603

MediumPublic PoC

Published: 12 February 2025

Published
12 February 2025
Modified
06 June 2025
KEV Added
—
Patch
—
CVSS Score v3.1 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
EPSS Score 0.0039 60.4th percentile
Risk Priority 13 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-57603 is a medium-severity Improper Control of Interaction Frequency (CWE-799) vulnerability in Mayswind Ezbookkeeping. Its CVSS base score is 6.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Brute Force (T1110); ranked in the top 39.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

EU & UK References

Vulnerability details

An issue in MaysWind ezBookkeeping 0.7.0 allows a remote attacker to escalate privileges via the lack of rate limiting.

CWE(s)
CWE-799

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1110 Brute Force Credential Access
Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained.
attack.mitre.org →
T1110.001 Password Guessing Credential Access
Adversaries with no prior knowledge of legitimate credentials within the system or environment may guess passwords to attempt access to accounts.
attack.mitre.org →
Why these techniques?

Lack of rate limiting on /api/authorize.json login endpoint and /api/2fa/recovery.json backup code endpoint enables brute force password guessing attacks, facilitating credential access via repeated login attempts without lockout.

Affected Assets

mayswind
ezbookkeeping
0.7.0

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

PL-6 Security-related Activity Planning
addresses: CWE-799

The control requires defining frequency, timing, and approval for security interactions, directly addressing uncontrolled interaction rates.

SC-6 Resource Availability
addresses: CWE-799

Allocation policies inherently restrict interaction frequency, reducing the impact of excessive requests.

SI-8 Spam Protection
addresses: CWE-799

Spam protection explicitly controls interaction frequency by detecting and acting on bulk unsolicited messages from external sources.

References