Description (CNA)
RAGFlow through 0.18.1 allows account takeover because it is possible to conduct successful brute-force attacks against email verification codes to perform arbitrary account registration, login, and password reset. Codes are six digits and there is no rate limiting.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| infiniflow / RAGFlow | affected 0 through 0.18.1 |
CWE
CWE-307
References
ADP enrichment
No English description supplied.