{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"0.11.4"}],"component":"pixelfed/pixelfed","cve_ids":["CVE-2023-0901"],"ecosystem":"Packagist","epss":0.00639,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-vjxx-jgcx-9fq2","id":"tcs_01M5KF98EJQJ4J2ETFJBVWZBHQ","modified_at":"2023-11-08T04:11:13.181575Z","published_at":"2023-02-18T03:30:17Z","references":["https://osv.dev/vulnerability/GHSA-vjxx-jgcx-9fq2","https://nvd.nist.gov/vuln/detail/CVE-2023-0901","https://github.com/pixelfed/pixelfed/commit/5b5f5bc38ca9ba39d0b7dacc3813fb899f71ba57","https://github.com/pixelfed/pixelfed","https://huntr.dev/bounties/0327b1b2-6e7c-4154-a307-15f236571010"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-vjxx-jgcx-9fq2","url":"https://osv.dev/vulnerability/GHSA-vjxx-jgcx-9fq2"}],"summary":"Pixelfed allows user enumeration via reset password functionality"}