medium5.3
CVE-2024-13274
Drupal Open Social allows Functionality Misuse
Impact
The distribution didn't validate the flood control limits on the password reset form correctly resulting in a potential attacker flooding the password reset which could result in a Denial of Service. Fortunately the message does not disclose any information to the attacker.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | goalgorilla/open_social | < 12.3.8 | 12.3.8 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Getopensocial | Open Social | before 12.3.8 from 12.4.0 before 12.4.5 |