HCL DevOps Velocity Brute-Force Vulnerability Due to Inadequate Rate Limiting

A vulnerability exists in HCL DevOps Velocity versions prior to 5.1.7, where rate limiting for user login attempts is not properly enforced. This flaw allows brute-force attacks to bypass the established limit on unsuccessful login attempts.

Impact

Exploitation of this vulnerability could lead to successful unauthorized access through brute-force login attempts.

Remediation

Users are advised to upgrade to HCL DevOps Velocity version 5.1.7 or later. The update can be obtained from the My HCLSoftware Portal.