Description
Concrete CMS (previously concrete5) before 9.1 did not have a rate limit for password resets.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | concrete5/concrete5 | < 9.1.0 | 9.1.0 | GHSA-ph6g-6v8w-8p6m |
Medium · 5.3
CVE-2023-28821
EUVD-2023-1366GHSA-ph6g-6v8w-8p6m
Missing rate limit for password resets
Published Apr 28, 2023 · Updated Jan 30, 2025 · Assigned by mitre