Project: 
Date: 
2018-December-05
Vulnerability: 
Denial of Service
Description: 

The Password Policy module makes it possible to set constraints on user passwords which disallow certain passwords.

The "digit placement" constraint is vulnerable to Denial of Service attacks if an attacker submits specially crafted passwords which can cause a site to become unresponsive.

This vulnerability is mitigated by the fact that a site must have the "digit placement" constraint enabled.

Solution: 

Install the latest version:

Reported By: 
Fixed By: 
Coordinated By: