StrangeBee TheHive Email Flooding Vulnerability

A vulnerability allowing email flooding has been identified in StrangeBee TheHive versions 5.2.0 prior to 5.2.16, 5.3.0 prior to 5.3.11, 5.4.0 prior to 5.4.10, and 5.5.0 prior to 5.5.1. This vulnerability allows unauthenticated remote attackers to abuse the password reset feature without restrictions. The consequences of this vulnerability include exhausting the mailbox storage of targeted users, damaging the reputation of the SMTP server which could lead to blacklisting, and overloading the outbound mail queue of the SMTP server.

Impact

Exploitation of this vulnerability can cause mailbox storage exhaustion for targeted users, damage the reputation of the SMTP server potentially leading to blacklisting, and overload the SMTP server's outbound mail queue.