GitHub Advisoryadvisory · Packagist

GHSA-63wg-87qv-rw4r Drupal Open Social allows Functionality Misuse

MEDIUM Published 2025-01-09 Modified 2025-01-14 Official page ↗
Aliases
CVE-2024-13274
Ecosystem
Packagist
Packages
goalgorilla/open_social
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weaknesses
CWE-799
Reviewed
2025-01-14

Affected packages

• Packagist goalgorilla/open_social: < 12.3.8 → fixed in 12.3.8 • Packagist goalgorilla/open_social: >= 12.4.0, < 12.4.5 → fixed in 12.4.5 • Packagist goalgorilla/open_social: >= 13.0.0-alpha1, < 13.0.0-alpha11 → fixed in 13.0.0-alpha11

Description

The distribution didn't validate the flood control limits on the password reset form correctly resulting in a potential attacker flooding the password reset which could result in a Denial of Service. Fortunately the message does not disclose any information to the attacker.

Related

Alias · CVE (1)

  • CVE-2024-13274 Improper Control of Interaction Frequency vulnerability in Drupal Open Social allows Functionality Misuse.This issue affects Open Social:… vulnerability

Weakness · CWE (1)

  • CWE-799 Improper Control of Interaction Frequency weakness

References