CVE-2023-28821: 
PHP vulnerability analysis and mitigation

Concrete CMS (previously concrete5) before version 9.1 contained a vulnerability related to password reset functionality. The vulnerability was identified and assigned CVE-2023-28821, with a disclosure date of April 20, 2023. This security issue affected all versions of Concrete CMS prior to version 9.1 (Vendor Advisory).

The vulnerability stemmed from the absence of a rate limit mechanism for password resets. The issue was assigned a CVSS v3.1 base score of 5.3 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L. The fix implemented in version 9.1 relies on a completely new library that was not present in version 8 (Vendor Advisory).

The lack of rate limiting on password reset functionality could potentially lead to denial of service conditions by allowing attackers to make unlimited password reset requests. This could affect system availability and potentially disrupt legitimate password reset attempts (Vendor Advisory).

The recommended mitigation is to upgrade to Concrete CMS version 9.1 or later, which includes the necessary rate limiting functionality for password resets (Vendor Advisory).