CVE-2024-57610

HighPublic PoC

Published: 06 February 2025

Published

06 February 2025

Modified

19 September 2025

KEV Added

—

Patch

—

CVSS Score 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Score 0.0977 93.0th percentile

Risk Priority 21 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-57610 is a high-severity Improper Restriction of Excessive Authentication Attempts (CWE-307) vulnerability in Sylius Sylius. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Brute Force (T1110); ranked in the top 7.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 AC-7 (Unsuccessful Logon Attempts) and SC-5 (Denial-of-service Protection).

Threat & Defense at a Glance

What attackers do: exploitation maps to Brute Force (T1110). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

AC-7 Unsuccessful Logon Attempts good match

prevent

AC-7 enforces restrictions on the number of consecutive unsuccessful logon attempts, directly preventing brute-force attacks on user accounts exploited by this CVE.

SC-5 Denial-of-service Protection good match

prevent

SC-5 implements denial-of-service protections such as rate limiting, mitigating the flooding of authentication endpoints that causes service disruption for legitimate users.

SC-7 Boundary Protection partial match

prevent

SC-7 provides boundary protection via firewalls or middleware to enforce rate limiting on external network access, addressing the remote unauthenticated brute-force exploitation.

MITRE ATT&CK Enterprise TechniquesAI

T1110 Brute Force Credential Access

Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained.

attack.mitre.org →

Why these techniques?

The absence of rate limiting on the login endpoint enables unrestricted brute-force attacks (T1110) against user accounts, facilitating credential guessing or spraying without restrictions.

NVD Description

A rate limiting issue in Sylius v2.0.2 allows a remote attacker to perform unrestricted brute-force attacks on user accounts, significantly increasing the risk of account compromise and denial of service for legitimate users. The Supplier's position is that the Sylius…

core software is not intended to address brute-force attacks; instead, customers deploying a Sylius-based system are supposed to use "firewalls, rate-limiting middleware, or authentication providers" for that functionality.

Deeper analysisAI

CVE-2024-57610 is a rate limiting vulnerability in Sylius version 2.0.2, an open-source e-commerce platform. The flaw enables remote attackers to bypass restrictions and perform unrestricted brute-force attacks on user accounts, elevating risks of account compromise and denial of service for legitimate users. It is associated with CWE-307 (Improper Restriction of Excessive Authentication Attempts) and carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating high severity primarily due to availability impact.

A remote, unauthenticated attacker can exploit this vulnerability over the network with low complexity and no user interaction. By sending unlimited authentication attempts, the attacker can guess credentials to gain unauthorized access to accounts or flood the login system, disrupting service for valid users.

The supplier maintains that Sylius core software is not intended to handle brute-force protection, advising customers to deploy firewalls, rate-limiting middleware, or external authentication providers for mitigation. Relevant resources include the Sylius GitHub repository (https://github.com/Sylius/Sylius), a dedicated CVE repository (https://github.com/nca785/CVE-2024-57610), and the Sylius website (https://sylius.com/).