magevulndb
magevulndb copied to clipboard
LS Retail Magento 2 `lsretailomni/lsmag-two` - no rate limiting
No request quantity validation for Customer-related operations (requests) Magento limits the number of “Password Reset” requests. The mechanism was not introduced in the LS_Customer module, which overrides the Password Reset process entirely.
https://github.com/lsretailomni/lsmag-two/blob/master/src/Customer/Controller/Account/ForgotPasswordPost.php
Solution for LS
\Magento\Security\Model\PasswordResetRequestEvent is implemented and implement it in LS module accordingly.