Lucene search

MendCVE-2022-23079

HistoryJun 22, 2022 - 1:15 p.m.

CVE-2022-23079

2022-06-2213:15:08

CWE-116

Mend

web.nvd.nist.gov

cve-2022-23079

motor-admin

host header injection

password reset

security vulnerability

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

AI Score

7.2

Confidence

High

EPSS

Percentile

12.8%

JSON

In motor-admin versions 0.0.1 through 0.2.56 are vulnerable to host header injection in the password reset functionality where malicious actor can send fake password reset email to arbitrary victim.

Affected configurations

Nvd

Node

getmotoradminmotor_adminRange0.0.1–0.2.56

VendorProductVersionCPE
getmotoradminmotor_admin*cpe:2.3:a:getmotoradmin:motor_admin:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
getmotoradmin	motor_admin	*	cpe:2.3:a:getmotoradmin:motor_admin::::::::

CNA Affected

[
  {
    "product": "motor-admin",
    "vendor": "motor-admin",
    "versions": [
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "0.0.1",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "0.2.56",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

github.com/motor-admin/motor-admin/commit/a461b7507940a1fa062836daa89c82404fe3ecf9

www.mend.io/vulnerability-database/CVE-2022-23079

Social References

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

AI Score

7.2

Confidence

High

EPSS

Percentile

12.8%

JSON

Related for CVE-2022-23079