DRUPAL-CONTRIB-2023-045

Import Source

https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/mail_login/DRUPAL-CONTRIB-2023-045.json

JSON Data

https://api.osv.dev/v1/vulns/DRUPAL-CONTRIB-2023-045

Published

2023-09-13T15:47:17Z

Modified

2025-12-10T23:33:19.208820Z

Summary

[none]

Details

This module enables users to log in by email address with minimal configurations.

Drupal core contains protection against brute force attacks via a flood control mechanism. This module's functionality did not replicate the flood control, enabling brute force attacks.

References

https://www.drupal.org/sa-contrib-2023-045

Credits

- Melisa Cordero
- - https://www.drupal.org/user/3655438

Affected packages

Packagist:https://packages.drupal.org/8 / drupal/mail_login

Package

Name: drupal/mail_login
Purl: pkg:composer/drupal/mail_login

Affected ranges

Type

ECOSYSTEM

Events

Introduced

Fixed

2.8.0

Database specific

{
    "constraint": "<2.8.0"
}

Database specific

affected_versions

"<2.8.0"

source

"https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/mail_login/DRUPAL-CONTRIB-2023-045.json"