CVE-2020-11052

In Sorcery before 0.15.0, there is a brute force vulnerability when using password authentication via Sorcery. The brute force protection submodule will prevent a brute force attack for the defined lockout period, but once expired, protection will not be re-enabled until a user or malicious actor logs in successfully. This does not affect users that do not use the built-in brute force protection submodule, nor users that use permanent account lockout. This has been patched in 0.15.0.

• CWE-307
• CWE-307

• https://github.com/Sorcery/sorcery/commit/0f116d223826895a73b12492f17486e5d54ab7a7Patch, Third Party Advisory
• https://github.com/Sorcery/sorcery/issues/231Third Party Advisory
• https://github.com/Sorcery/sorcery/pull/235Patch, Third Party Advisory
• https://github.com/Sorcery/sorcery/security/advisories/GHSA-jc8m-cxhj-668xThird Party Advisory
• https://github.com/Sorcery/sorcery/commit/0f116d223826895a73b12492f17486e5d54ab7a7Patch, Third Party Advisory
• https://github.com/Sorcery/sorcery/issues/231Third Party Advisory
• https://github.com/Sorcery/sorcery/pull/235Patch, Third Party Advisory
• https://github.com/Sorcery/sorcery/security/advisories/GHSA-jc8m-cxhj-668xThird Party Advisory

Published

May 7, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-11047In FreeRDP after 1.1 and before 2.0.0, there is an out-of-bo…5.9
• CVE-2020-11048In FreeRDP after 1.0 and before 2.0.0, there is an out-of-bo…2.2
• CVE-2020-11049In FreeRDP after 1.1 and before 2.0.0, there is an out-of-bo…2.2
• CVE-2020-1105A spoofing vulnerability exists when Microsoft SharePoint Se…5.4
• CVE-2020-11050In Java-WebSocket less than or equal to 1.4.1, there is an I…8.1
• CVE-2020-11051In Wiki.js before 2.3.81, there is a stored XSS in the Markd…4.8
• CVE-2020-11053In OAuth2 Proxy before 5.1.1, there is an open redirect vuln…6.1
• CVE-2020-11054In qutebrowser versions less than 1.11.1, reloading a page w…3.5
• CVE-2020-11055In BookStack greater than or equal to 0.18.0 and less than 0…5.4
• CVE-2020-11056In Sprout Forms before 3.9.0, there is a potential Server-Si…6.3
• CVE-2020-11057In XWiki Platform 7.2 through 11.10.2, registered users with…8.8
• CVE-2020-11058In FreeRDP after 1.1 and before 2.0.0, a stream out-of-bound…2.2