medium5.3
CVE-2023-28821
Missing rate limit for password resets
Impact
Concrete CMS (previously concrete5) before 9.1 did not have a rate limit for password resets.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | concrete5/concrete5 | < 9.1.0 | 9.1.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Concretecms | Concrete Cms | before 9.1.0 |