Zikula before 1.2.3 does not use the authid protection mechanism for (1) the lostpassword form and (2) mailpasswd processing, which makes it easier for remote attackers to generate a flood of password requests and possibly conduct cross-site request forgery (CSRF) attacks via multiple form submissions.
Get an AI-powered plain-language explanation of this vulnerability and remediation steps.
Login to generate AI explanation4 reference(s) from NVD