CVE-2025-23001

Katalog CVE

CVSS 6.1 · Medium EPSS 0,30%

Kerentanan Improper Neutralization of HTTP Headers for Scripting Syntax. Skor CVSS 3.1 6.1 (Medium) menurut CISA ADP.

Deskripsi (NVD)

A Host header injection vulnerability exists in CTFd 3.7.5, due to the application failing to properly validate or sanitize the Host header. An attacker can manipulate the Host header in HTTP requests, which may lead to phishing attacks, reset password, or cache poisoning. NOTE: the Supplier's position is that the end user is supposed to edit the NGINX configuration template to set server_name (with this setting, Host header injection cannot occur).

Rincian

Terbit di NVD

31 Januari 2025

Terakhir diubah

17 Juni 2026

Status NVD

Deferred

CVSS 3.1

6.1 (Medium), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-644: Improper Neutralization of HTTP Headers for Scripting Syntax

EPSS (30 hari)

0,30% peluang dieksploitasi; lebih tinggi dari 20,6% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://blog.ctfd.io/ctfd-3-7-6/
• https://codetoanbug.com/poc-cve-2025-23001-ctfd-english/
• https://github.com/CTFd/CTFd