vantage6 lacks brute-force protection on change password functionality
ImpactIf attacker gets access to an authenticated session, they can try to brute-force the user password by using the change password functionality: they can call that route infinitely which will return the message that password is wrong until it is correctPatchesThis issue has been patched in version 4.11.0WorkaroundsNone