In Userfrosting, versions v0.3.1 to v4.6.2 are vulnerable to Host Header Injection. By luring a victim application user to click on a link, an unauthenticated attacker can use the “forgot password” functionality to reset the victim’s password and successfully take over their account.
References
Link | Resource |
---|---|
https://github.com/userfrosting/UserFrosting/commit/796dd78757902435d1bd286415feea78098e45ba | Patch Third Party Advisory |
https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25994 | Exploit Third Party Advisory |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: Mend
Published: 2022-01-03T06:45:10
Updated: 2022-01-03T06:45:10
Reserved: 2021-01-22T00:00:00
Link: CVE-2021-25994
JSON object: View
NVD Information
Status : Analyzed
Published: 2022-01-03T07:15:07.243
Modified: 2022-01-13T17:43:02.343
Link: CVE-2021-25994
JSON object: View
Redhat Information
No data.
CWE