In short
- CVE-2019-15929 is a CRITICAL (CVSS 9.8) vulnerability affecting craftcms/cms, craft cms (craftcms).
- Chance of exploitation in the next 30 days (EPSS): 1.8%, higher than 77.9% of all vulnerabilities.
- Fix: update to 3.1.7 or later.
Description
In Craft CMS before 3.1.7, the elevated session password prompt was not being rate limited like normal login forms, leading to the possibility of a brute force attempt on them.
NVD description
In Craft CMS through 3.1.7, the elevated session password prompt was not being rate limited like normal login forms, leading to the possibility of a brute force attempt on them.
More vulnerabilities in craftcms/cms
See all →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free