CVE-2019-15929: Critical severity craft cms vulnerability
Published Oct 24, 2019
·Updated
In Craft CMS before 3.1.7, the elevated session password prompt was not being rate limited like normal login forms, leading to the possibility of a brute force attempt on them.
Other sources
In Craft CMS through 3.1.7, the elevated session password prompt was not being rate limited like normal login forms, leading to the possibility of a brute force attempt on them.
Affected Software
2 affected componentsFixes available
composer/craftcms/cms<3.1.7
3.1.7
Craft CMS<=3.1.7
Event History
Oct 24, 2019
CVE Published
via MITRE·03:53 PM
Data Sourced
via MITRE·03:53 PM
Description
May 24, 2022
Advisory Published
via GitHub·04:59 PM
Frequently Asked Questions
1
What is the vulnerability ID for this Craft CMS vulnerability?
The vulnerability ID for this Craft CMS vulnerability is CVE-2019-15929.
2
What is the severity of CVE-2019-15929?
The severity of CVE-2019-15929 is critical, with a severity value of 9.8.
3
What is affected by CVE-2019-15929?
Craft CMS versions up to and including 3.1.7 are affected by CVE-2019-15929.
4
What is the risk of CVE-2019-15929?
CVE-2019-15929 poses a risk of brute force attempts on elevated session passwords in Craft CMS.
5
Is there a fix for CVE-2019-15929?
Yes, updating Craft CMS to version 3.1.8 or higher will fix CVE-2019-15929.