Critical severity9.8NVD Advisory· Published Oct 24, 2019· Updated Jun 17, 2026
CVE-2019-15929
CVE-2019-15929
Description
In Craft CMS through 3.1.7, the elevated session password prompt was not being rate limited like normal login forms, leading to the possibility of a brute force attempt on them.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
craftcms/cmsPackagist | < 3.1.7 | 3.1.7 |
Affected products
2- Craft CMS/Craft CMSdescription
Patches
Vulnerability mechanics
References
5- packetstormsecurity.com/files/155012/Craft-CMS-Rate-Limiting-Brute-Force.htmlnvdThird Party Advisory
- github.com/advisories/GHSA-wvr4-w6cw-4px8ghsaADVISORY
- github.com/craftcms/cms/blob/develop/CHANGELOG-v3.mdnvdRelease NotesThird Party Advisory
- nvd.nist.gov/vuln/detail/CVE-2019-15929ghsaADVISORY
- github.com/craftcms/cms/blob/3.1.7/CHANGELOG-v3.mdghsaWEB
News mentions
0No linked articles in our index yet.