Totara LMS Forgot Password API Rate Limiting Vulnerability Allowing Email Bombing

A vulnerability exists in Totara LMS versions through 19.1.5 in the forgot password API, which lacks rate limiting for the target email address. This oversight can be exploited to launch an email bombing attack on the victim's email.

Impact

Exploitation of this vulnerability can lead to an email bombing attack, where a victim's email is flooded with messages, potentially causing disruption or inconvenience.

Remediation

It is recommended to implement rate limiting for the forgot password API to prevent abuse.