CVE-2019-15929 - In Craft CMS through 3.1.7, the elevated session password prompt was not being rate limited like normal login forms, leading to the possibility of a brute force attempt on them

Back Back to CVE browser

CRITICAL

In Craft CMS through 3.1.7, the elevated session password prompt was not being rate limited like normal login forms, leading to the possibility of a brute force attempt on them

Published Oct 24, 2019

9.8

CRITICAL

CVSS 3.1

EPSS 1.75%

Description

In Craft CMS through 3.1.7, the elevated session password prompt was not being rate limited like normal login forms, leading to the possibility of a brute force attempt on them.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-640

References (5)

http://packetstormsecurity.com/files/155012/Craft-CMS-Rate-Limiting-Brute-Force.html
x_refsource_MISCThird Party Advisory
https://github.com/advisories/GHSA-wvr4-w6cw-4px8
Advisory
https://github.com/craftcms/cms/blob/3.1.7/CHANGELOG-v3.md
https://github.com/craftcms/cms/blob/develop/CHANGELOG-v3.md#317---2019-01-31
x_refsource_MISCRelease NotesThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-15929

Link	Providers	Tags
http://packetstormsecurity.com/files/155012/Craft-CMS-Rate-Limiting-Brute-Force.html		x_refsource_MISCThird Party Advisory
https://github.com/advisories/GHSA-wvr4-w6cw-4px8		Advisory
https://github.com/craftcms/cms/blob/3.1.7/CHANGELOG-v3.md
https://github.com/craftcms/cms/blob/develop/CHANGELOG-v3.md#317---2019-01-31		x_refsource_MISCRelease NotesThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-15929

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Oct 24, 2019

Updated Aug 5, 2024

Reserved Sep 4, 2019

Link CVE-2019-15929

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2019-15929

Red Hat

Severity n/a

Public date n/a

Links CVE-2019-15929

GHSA-WVR4-W6CW-4PX8