GHSA-63wg-87qv-rw4r

ghsaUSosv

Drupal Open Social allows Functionality Misuse

view advisory published 2025-01-09Licence: CC-BY-4.0

The distribution didn't validate the flood control limits on the password reset form correctly resulting in a potential attacker flooding the password reset which could result in a Denial of Service. Fortunately the message does not disclose any information to the attacker.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2024-13274US	—	0.38% (32nd)	—	2025-01-09
Improper Control of Interaction Frequency vulnerability in Drupal Open Social allows Functionality Misuse.This issue affects Open Social: from 0.0.0 before 12.3.8, from 12.4.0 befo…

references

External citations — patches, advisories, analysis.

https://github.com/goalgorilla/open_socialPACKAGE
https://nvd.nist.gov/vuln/detail/CVE-2024-13274ADVISORY
https://www.drupal.org/sa-contrib-2024-038WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan