CVE-2017-8827

CRITICAL

GeniXCMS < 1.1.2 - Denial of Service via Forgot Password Rate Limit Bypass

Title source: llm
STIX 2.1

Description

forgotpassword.php in GeniXCMS 1.0.2 lacks a rate limit, which might allow remote attackers to cause a denial of service (login inability) or possibly conduct Arbitrary User Password Reset attacks via a series of requests.

References (1)

Core 1
Core References
Issue Tracking, Patch, Third Party Advisory x_refsource_misc
https://github.com/semplon/GeniXCMS/issues/75

Scores

CVSS v3 9.1
EPSS 0.0162
EPSS Percentile 73.0%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Details

CWE
CWE-287
Status published
Products (2)
genix/cms 0 - 1.1.2Packagist
genixcms/genixcms 1.0.2
Published May 08, 2017
Tracked Since Feb 18, 2026