CVE-2010-4729 Zikula before 1.2.3 does not use the authid protection mechanism for (1) the lostpassword form and (2) mailpasswd processing, which makes it easier for remote attackers to generate a flood of password...
MediumCVSS 6.8
EPSS 0.52%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Zikula before 1.2.3 does not use the authid protection mechanism for (1) the lostpassword form and (2) mailpasswd processing, which makes it easier for remote attackers to generate a flood of password requests and possibly conduct cross-site request forgery (CSRF) attacks via multiple form submissions.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| zikula application framework | <= 1.2.2 | No fix listed |
| zikula application framework | = 1.1.2 | No fix listed |
| zikula application framework | = 1.2.1 | No fix listed |