Pimcore before 6.2.2 lacks brute force protection for the 2FA token.
mitre·CWE-307·Published 2019-11-15