CVE-2021-25994 — Userfrosting - Host-Header Injection Leads to Account Takeover
In Userfrosting, versions v0.3.1 to v4.6.2 are vulnerable to Host Header Injection. By luring a victim application user to click on a link, an unauthenticated attacker can use t…
Published: 2022-01-03 · CVSS: 8.8 · CVSS 3.1
In Userfrosting, versions v0.3.1 to v4.6.2 are vulnerable to Host Header Injection. By luring a victim application user to click on a link, an unauthenticated attacker can use the “forgot password” functionality to reset the victim’s password and successfully take over their account.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7