CVE-2021-36804

Katalog CVE

CVSS 8.1 · High EPSS 0,96%

Kerentanan Weak Password Recovery Mechanism for Forgotten Password pada akaunting. Skor CVSS 3.1 8.1 (High) menurut NVD.

Deskripsi (NVD)

Akaunting version 2.1.12 and earlier suffers from a password reset spoofing vulnerability, wherein an attacker can proxy password reset requests through a running Akaunting instance, if that attacker knows the target's e-mail address. This issue was fixed in version 2.1.13 of the product. Please note that this issue is ultimately caused by the defaults provided by the Laravel framework, specifically how proxy headers are handled with respect to multi-tenant implementations. In other words, while this is not technically a vulnerability in Laravel, this default configuration is very likely to lead to practically identical identical vulnerabilities in Laravel projects that implement multi-tenant applications.

Rincian

Terbit di NVD

4 Agustus 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.1 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-640: Weak Password Recovery Mechanism for Forgotten Password

EPSS (30 hari)

0,96% peluang dieksploitasi; lebih tinggi dari 60,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/laravel/laravel/pull/5477 issue tracking · patch · advisory pihak ketiga
• https://www.laravel-enlightn.com/docs/security/host-injection-analyzer.html advisory pihak ketiga
• https://www.rapid7.com/blog/post/2021/07/27/multiple-open-source-web-app-vulnerabilities-fixed/ exploit · advisory pihak ketiga