CVE-2010-4729

Zikula before 1.2.3 does not use the authid protection mechanism for (1) the lostpassword form and (2) mailpasswd processing, which makes it easier for remote attackers to generate a flood of password requests and possibly conduct cross-site request forgery (CSRF) attacks via multiple form submissions.

Score

CVSS 2.0 6.8 Medium

Status

Modified - cve@mitre.org

Published

2011-02-08

Last modified

2024-09-16

Weaknesses

CWE-352

Affected products

• Zikula Application Framework (Zikula)

References

• http://code.zikula.org/core/ticket/1979
• http://code.zikula.org/core12/browser/tags/Zikula-1.2.5/src/docs/CHANGELOG