GitHub Advisoryadvisory · Packagist

GHSA-ph6g-6v8w-8p6m Missing rate limit for password resets

MEDIUM Published 2023-04-28 Modified 2023-05-01 Official page ↗

Aliases: CVE-2023-28821
Ecosystem: Packagist
Packages: concrete5/concrete5
Severity: Moderate
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weaknesses: CWE-640
Reviewed: 2023-05-01

Affected packages

• Packagist concrete5/concrete5: < 9.1.0 → fixed in 9.1.0

Description

Concrete CMS (previously concrete5) before 9.1 did not have a rate limit for password resets.

Related

Alias · CVE (1)

CVE-2023-28821 Concrete CMS (previously concrete5) before 9.1 did not have a rate limit for password resets. vulnerability

Weakness · CWE (1)

CWE-640 Weak Password Recovery Mechanism for Forgotten Password weakness

References