magevulndb icon indicating copy to clipboard operation
magevulndb copied to clipboard

LS Retail Magento 2 `lsretailomni/lsmag-two` - no rate limiting

Open lbajsarowicz opened this issue 2 years ago • 0 comments

No request quantity validation for Customer-related operations (requests) Magento limits the number of “Password Reset” requests. The mechanism was not introduced in the LS_Customer module, which overrides the Password Reset process entirely.

https://github.com/lsretailomni/lsmag-two/blob/master/src/Customer/Controller/Account/ForgotPasswordPost.php

Solution for LS

\Magento\Security\Model\PasswordResetRequestEvent is implemented and implement it in LS module accordingly.

lbajsarowicz avatar Apr 25 '23 11:04 lbajsarowicz