| Package | Affected versions | Patched versions |
|---|---|---|
| goalgorilla/open_social | ≥ 12.4.0, < 12.4.5≥ 13.0.0-alpha1, < 13.0.0-alpha11< 12.3.8 | 12.4.513.0.0-alpha1112.3.8 |
| drupal/social | ≥ 12.4.0, < 12.4.5≥ 13.0.0-alpha1, < 13.0.0-alpha11< 12.3.8 | 12.4.513.0.0-alpha1112.3.8 |
| open social | ≥ 12.4.0, < 12.4.5< 12.3.8 | 12.4.512.3.8 |
The distribution didn't validate the flood control limits on the password reset form correctly resulting in a potential attacker flooding the password reset which could result in a Denial of Service. Fortunately the message does not disclose any information to the attacker.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free