What is GHSA-cv25-3gmg-c6m8?

GHSA-cv25-3gmg-c6m8 is a security advisory published by GitHub Security Advisories with High severity. Injection in UserFrosting

Which CVE IDs does GHSA-cv25-3gmg-c6m8 cover?

GHSA-cv25-3gmg-c6m8 covers the following CVE IDs: CVE-2021-25994. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-cv25-3gmg-c6m8?

GHSA-cv25-3gmg-c6m8 has a CVSS v3 base score of 8.8, published by GitHub Security Advisories.

Which products are affected by GHSA-cv25-3gmg-c6m8?

GHSA-cv25-3gmg-c6m8 affects 1 product, including: composer/userfrosting/userfrosting:\u003e= 0.3.1, \u003c 4.6.3.

GHSA-cv25-3gmg-c6m8HighCVSS 8.8

Injection in UserFrosting

Vendor

GitHub Security Advisories

Published

January 6, 2022

Last Modified

February 3, 2023

🔗 CVE IDs covered (1)

CVE-2021-25994 →

📋 Description

In Userfrosting, versions v0.3.1 to v4.6.2 are vulnerable to Host Header Injection. By luring a victim application user to click on a link, an unauthenticated attacker can use the “forgot password” functionality to reset the victim’s password and successfully take over their account.

🎯 Affected products1

composer/userfrosting/userfrosting:>= 0.3.1, < 4.6.3

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2021-25994
https://github.com/userfrosting/UserFrosting/commit/796dd78757902435d1bd286415feea78098e45ba
https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25994
https://github.com/advisories/GHSA-cv25-3gmg-c6m8