Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
In Totara LMS v19.1.5 and before, the forgot password API does not implement rate limiting for the target email address. which can be used for an Email Bombing attack. NOTE: the Supplier's position is that the pwresettime configuration defaults to 30 minutes, the pwresettime configuration is a hard control enforced via flag PWRESET_STATUS_ALREADYSENT, and no further password-reset email messages are sent if this flag is active for a specific email address.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
Totara LMS 安全漏洞
Vulnerability Description
Totara LMS是Totara公司的一个学习管理系统。 Totara LMS v19.1.5及之前版本存在安全漏洞，该漏洞源于忘记密码API未对目标电子邮件地址实施速率限制，可能导致电子邮件轰炸攻击。
CVSS Information
N/A
Vulnerability Type
N/A