CVE-2021-3663: 
PHP vulnerability analysis and mitigation

The vulnerability CVE-2021-3663 was identified in firefly-iii software, relating to Improper Restriction of Excessive Authentication Attempts. The issue was discovered and recorded on July 23, 2021, affecting firefly-iii versions up to and including 5.5.12 (NVD, CVE).

The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N by NIST. Additionally, huntr.dev assessed it with a CVSS 3.0 score of 5.3 (MEDIUM) with vector string CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. The vulnerability is categorized under CWE-307 (Improper Restriction of Excessive Authentication Attempts) (NVD).

The vulnerability could potentially allow attackers to perform unlimited authentication attempts against the system, which could lead to unauthorized access through brute force attacks. This is particularly concerning as it could result in compromised user accounts and unauthorized access to sensitive information (NVD).

The vulnerability has been documented with proof of concept available. The attack vector is network-accessible (AV:N) with low attack complexity (AC:L) and requires no privileges (PR:N) or user interaction (UI:N) according to the CVSS metrics (NVD).

A patch has been released to address this vulnerability through a commit that adds a missing rate limiter to the authentication system. The fix implements the ThrottlesLogins trait in the LoginController (GitHub Patch).