Project Ricochet's top notch developers, designers and PM’s allowed us to bring our vision of an e-commerce style class search to life. We had a tight budget and a lot of unexpected problems on the Berkeley side. Utilizing Ricochet's state of the art tracking tools and disciplined scrum approach allowed us to surmount every challenge and end up with a fantastic application. We loved the creative collaboration that allowed us to remake a boring campus class schedule into a high-octane search tool that our students and faculty love! Thank you Casey and the whole PR team!
—Johanna Metzgar

Open Social - Moderately critical - Denial of Service - SA-CONTRIB-2024-038

Wed, 2024-09-04 09:20 — Anonymous (not verified)

Project: Open SocialDate: 2024-September-04Security risk: Moderately critical 10∕25 AC:Basic/A:None/CI:None/II:None/E:Theoretical/TD:AllVulnerability: Denial of ServiceAffected versions: <12.3.8 || >=12.4.0 <12.4.5 || >=13.0.0 <13.0.0-alpha11Description: Open Social is a Drupal distribution for online communities.
The distribution didn't validate the flood control limits on the password reset form correctly resulting in a potential attacker flooding the password reset which could result in a Denial of Service. Fortunately the message does not disclose any information to the attacker.Solution: Install the latest version:

If you use Open Social 12.3.x, upgrade to Open Social 12.3.8
If you use Open Social 12.4.x, upgrade to Open Social 12.4.5

Reported By:

vnech

Fixed By:

Coordinated By:

Greg Knaddison of the Drupal Security Team
Juraj Nemec of the Drupal Security Team
Heine Deelstra of the Drupal Security Team

Path to article https://www.drupal.org/sa-contrib-2024-038

Search form

Open Social - Moderately critical - Denial of Service - SA-CONTRIB-2024-038