CVE-2023-28821
Concrete CMS (previously concrete5) before 9.1 did not have a rate limit for password resets.
Summary
Missing rate limit for password resets
Original description
The description as published by the source.
Concrete CMS (previously concrete5) before 9.1 did not have a rate limit for password resets.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
Packagist
concrete5/concrete5
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.0"}]}]
References
- advisory nvd.nist.gov
- advisory concretecms.org
- advisory github.com
- package github.com