CVE-2023-38877

Katalog CVE

CVSS 8.8 · High EPSS 1,1%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada economizzer. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

A host header injection vulnerability exists in gugoan's Economizzer v.0.9-beta1 and commit 3730880 (April 2023). By sending a specially crafted host header in the reset password request, it is possible to send password reset links to users which, once clicked, lead to an attacker-controlled server and thus leak the password reset token. This allows an attacker to reset other users' passwords.

Rincian

Terbit di NVD

28 September 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-94: Improper Control of Generation of Code ('Code Injection')

EPSS (30 hari)

1,1% peluang dieksploitasi; lebih tinggi dari 63,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/dub-flow/vulnerability-research/tree/main/CVE-2023-38877 exploit · advisory pihak ketiga
• https://github.com/gugoan/economizzer/ product
• https://www.economizzer.org product