CVE-2021-25994

EUVD-2022-0565
In Userfrosting, versions v0.3.1 to v4.6.2 are vulnerable to Host Header Injection. By luring a victim application user to click on a link, an unauthenticated attacker can use the “forgot password” functionality to reset the victim’s password and successfully take over their account.
Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.8 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
MendCNA
8.8 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 82%
Affected Products (NVD)
VendorProductVersion
userfrostinguserfrosting
0.3.1 ≤
𝑥
< 4.6.3
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/userfrosting/UserFrosting/commit/796dd78757902435d1bd286415feea78098e45ba
https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25994
https://github.com/userfrosting/UserFrosting/commit/796dd78757902435d1bd286415feea78098e45ba
https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25994