GHSA-63wg-87qv-rw4r
Drupal Open Social allows Functionality Misuse
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | goalgorilla/open_social | < 12.3.8 | 12.3.8 |
| Packagist | goalgorilla/open_social | >= 12.4.0, < 12.4.5 | 12.4.5 |
| Packagist | goalgorilla/open_social | >= 13.0.0-alpha1, < 13.0.0-alpha11 | 13.0.0-alpha11 |
Details
As written in the advisory (Markdown source, shown as plain text).
The distribution didn't validate the flood control limits on the password reset form correctly resulting in a potential attacker flooding the password reset which could result in a Denial of Service. Fortunately the message does not disclose any information to the attacker.
References
External links from the advisory. They lead to third-party sites.