-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from improper flood control in Open Social's password reset flow. Drupal core uses flood control mechanisms in user module forms (e.g., user_pass_reset), but Open Social likely implements a custom password reset form/controller. The absence of flood service calls (e.g., \Drupal::flood()->isAllowed()) in critical functions would explain the missing validation. The confidence is medium because while the exact code isn't available, the pattern matches Drupal's flood control architecture and Open Social's modular structure.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| goalgorilla/open_social | composer | < 12.3.8 | 12.3.8 |
| goalgorilla/open_social | composer | >= 12.4.0, < 12.4.5 | 12.4.5 |
| goalgorilla/open_social | composer | >= 13.0.0-alpha1, < 13.0.0-alpha11 | 13.0.0-alpha11 |