{"id":"GHSA-r37h-j483-cjjm","aliases":["CVE-2021-33563"],"title":"Improper rate limiting in Koel","description":"Koel before 5.1.4 lacks login throttling, lacks a password strength policy, and shows whether a failed login attempt had a valid username. This might make brute-force attacks easier.","severity":"high","score":null,"published":"2021-06-01T21:38:20.000Z","modified":"2024-12-02T05:55:17.480Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"phanan/koel","ranges":[{"events":[{"introduced":"0"},{"fixed":"5.1.4"}],"type":"ECOSYSTEM"}],"versions":["1.0.0-beta","v0.0.0-beta","v1.1.1","v1.1.2","v2.0.0","v2.0.1","v2.0.2","v2.1.0","v2.2.0","v2.2.1","v3.0.0","v3.0.1","v3.1.0","v3.1.1","v3.2.0","v3.3.0","v3.3.1","v3.4.0","v3.4.1","v3.5.0","v3.5.1","v3.5.2","v3.5.3","v3.5.4","v3.5.5","v3.6.0","v3.6.1","v3.6.2","v3.7.0","v3.7.1","v3.7.2","v4.0.0","v4.1.0","v4.1.1","v4.2.0","v4.2.1","v4.2.2","v4.3.0","v4.3.1","v4.4.0","v5.0.0","v5.0.1","v5.0.2","v5.1.0","v5.1.1","v5.1.2","v5.1.3"],"fixed":["5.1.4"]}],"sourceAffected":[],"references":["https://nvd.nist.gov/vuln/detail/CVE-2021-33563","https://github.com/koel/koel/releases/tag/v5.1.4","https://huntr.dev/bounties/1-other-koel/koel"],"sources":[{"name":"OSV","id":"GHSA-r37h-j483-cjjm","modified":"2024-12-02T05:55:17.480120Z","url":"https://osv.dev/vulnerability/GHSA-r37h-j483-cjjm"}],"assessments":[]}