CVE-2023-28821

Concrete CMS previously concrete5 before 9.1 did not have a rate limit for password resets...

CVE-2023-28821

Concrete CMS previously concrete5 before 9.1 did not have a rate limit for password resets...

CVE-2023-28821

Concrete CMS (formerly concrete5) prior to 9.1 is affected by CVE-2023-28821 due to missing rate limiting on password resets in forgot_password. This is a low/medium-severity issue (CVSS 3.1: 5.3) with network attack vector, no privileges required, and no user interaction. The underlying problem ...